AIKIDO-2026-724507

TL;DR

magento/magento-cloud-metapackage pulls Adobe Commerce, which ships Magento's template system and GraphQL stack. An unauthenticated requester can inject PHP through styles properties on GraphQL requests, persist it via a failure report, then have it execute when Magento renders the Payment Transaction Failed Reminder email. Delivery of that email is not required because the payload runs during render. Successful exploitation leads to remote code execution and lets a backdoor be installed.