{"items":[{"id":"NVI-00006367","kind":"vulnerability","title":"Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-26hq-7286-mg8f"],"plain_summary":"OSV carries this publisher advisory for magento/community-edition. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 1.14.3.2 for magento/community-edition. Confirm the publisher’s latest guidance.","source_ids":["sr-b1d04757ba7eb47579d48eb54328c8b3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b1d04757ba7eb47579d48eb54328c8b3","url":"https://github.com/advisories/GHSA-26hq-7286-mg8f","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-26hq-7286-mg8f","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:40.011Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b1d04757ba7eb47579d48eb54328c8b3"],"technology":"magento/community-edition","known_exclusions":[],"conditions_summary":"Zend Framework 1 vulnerability can be remotely exploited to execute code in Magento 1. While the issue is not reproducible in Magento 2, the library code is the same so it was fixed as well.\n\nNote: while the vulnerability is scored as critical, few systems are affected. To be affected by the vulnerability the installation has to:\n\n- use sendmail as the mail transport agent\n\n- have specific, non-default configuration settings as described here.","public_affected_ranges":["ECOSYSTEM: introduced 1.9.0.0; fixed 1.14.3.2"]}],"null_published_at":"2026-10-31T22:13:10.053Z","source_updated_at":"2024-05-15T22:33:44.000Z","source_disclosed_at":"2024-05-15T22:33:44.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:40.011Z"}],"next_cursor":null,"snapshot_revision":"42594"}