LoginSign Up
← Back to all sparks
S

Sylius

E-COMM
Velocity2.5

Open source headless commerce platform built on Symfony for tailored ecommerce experiences.

sylius.com ↗

Sylius hits another Host header injection, this time in the shop reset email

securityecommercemulti-branch-supportsymfonypromotionsapi
◆Current state
v1.14.21 is a security release fixing a disabled API reachable through percent-encoded paths, Host header injection in shop password reset emails when a channel has no hostname, and unpublished reviews exposed by the Shop API. It follows the September patches across 1.12, 1.13 and 1.14 for JWT audience confusion and an admin reset Host header flaw. v2.3.0-ALPHA.1, with Symfony 8, dark mode and per-channel promotions, is the latest development release in view.
◆Where it's heading
Security patching dominates the visible 1.x stream, and the recurrence matters: the same Host header class has now surfaced in both admin and shop reset flows. The 2.x line carries the platform modernization and new commerce capability. The entries show nothing further on it since August, so the pace of the path to a 2.3 beta is unclear.
◆Prediction
Expect further 1.14 security patches while the branch is supported. The next 2.3 pre-release is the signal to watch for commerce features.

◆Recent moves

  1. 22d ago

    v1.14.21: API path bypass, shop reset link and review leak fixes

    Fixes three vulnerabilities, including a disabled API reachable through percent-encoded paths and another Host header flaw, now in shop reset emails. The repeat of September's bug class in a different flow suggests the problem was wider than one link.

    View source ↗
  2. 2mo ago

    v1.12.25: Critical JWT and Host header security patch

    Security patch for v1.12: fixes JWT audience confusion (shop customer auth as admin) and Host header injection in admin password-reset links. These are the same vulnerabilities patched simultaneously in v1.13 and v1.14 — coordinated multi-branch security release.

    View source ↗
  3. 2mo ago

    v1.14.20: Critical JWT and Host header security patch

    Security patch for v1.14: same two vulnerabilities as v1.12.25 and v1.13.17 — JWT audience confusion and Host header injection in admin password reset. Multi-version coordinated release.

    View source ↗
  4. 2mo ago

    v1.13.17: Critical JWT and Host header security patch

    Security patch for v1.13: closes the same JWT audience confusion and Host header injection vulnerabilities shipped simultaneously across all supported stable branches. Sylius' ability to patch three concurrent major versions in one release window reflects a mature support model.

    View source ↗
  5. 3mo ago

    v2.3.0-ALPHA.1: Symfony 8, dark mode, and per-channel promotions

    v2.3.0-ALPHA.1 is the most significant entry in this window: PHP 8.3+, Symfony 8, and DBAL 4 support alongside dark mode for the admin panel and per-channel promotion rules. The per-channel promotion configuration is a real commerce capability gain for multi-market merchants, but it remains alpha and not yet suitable for production.

    View source ↗
  6. 8mo ago

    v1.14.19

    v1.14.19 ships telemetry improvements — internal instrumentation changes with no user-visible effect.

    View source ↗