Preliminary research

CVE-2026-103849 PoC re-analysis

Nicolas Krassas · GitHub · 18 October 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Reproduces BlockStrap through guest GraphQL with matched vulnerable/patched controls and fresh sink markers. Explains the signing bridge between rendering phases and a bounded stock CSV side effect; command execution requires a labeled synthetic gadget, and a stock full-RCE chain is not demonstrated.

Record

Researcher

Nicolas Krassas

Published by

GitHub

Date

18 October 2026

Format

Code

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• BlockStrap validation lab
• BlockStrap validation evidence
• Earlier disclosure
• September signing analysis

Tags

• magento
• graphql
• ssti
• patch-diffing
• reproduction
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Nicolas Krassas, first published at the original source. Preserved copies are kept so the citation survives its host.