Patch Forecast
Amber warning
Patch this week.

CVE-2026-105642 · GHSA-788w-68h3-cvxp

Ghost: Remote Code Execution via Bookmark Card Images

Risk score
66/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.3%
Published
5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the…
Affected
ghost (npm) >= 6.56.0, < 6.67.0
Fix
Upgrade ghost to 6.67.0 or later.
Exploitation
No known exploitation

Story map

Story map: ghostTHE FLAWSTHE FIXCVE-2026-105642Ghost: Remote Code Executionvia Bookmark Card ImagesCVSS 8.8 · EPSS 0%CVE-2026-105650Ghost: Stored XSS via oEmbedPhoto ResponsesCVSS 8.1 · EPSS 0%CVE-2026-105677Ghost: Remote Code Executionvia Theme Translation FilesCVSS 7.2 · EPSS 1%CVE-2026-105675Ghost: Invite Token Disclosurein Ghost Admin APICVSS 7.5 · EPSS 0%Upgrade ghost6.67.0 · 6.64.0or later on your release lineWho is exposedghost (npm) >= 6.56.0, < 6.67.0AMBER · PATCH THIS WEEKghostGhost is a Node.js contentmanagement system. From6.56.0 until 6.67.0, an imageprocessing library bundled withGhost contained a vulnerabilityin its SVG handling. Any staffuser, including Contributors…Where it standsNo known exploitationCONNECTS TOSame weaknessCode injection (CWE-94)238 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

ghost: Amber, patch this week. Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the…

The flaws

  • CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images (CVSS 8.8 · EPSS 0%)
  • CVE-2026-105650: Ghost: Stored XSS via oEmbed Photo Responses (CVSS 8.1 · EPSS 0%)
  • CVE-2026-105677: Ghost: Remote Code Execution via Theme Translation Files (CVSS 7.2 · EPSS 1%)
  • CVE-2026-105675: Ghost: Invite Token Disclosure in Ghost Admin API (CVSS 7.5 · EPSS 0%)

The fix

Upgrade ghost: 6.67.0 · 6.64.0 or later on your release line

Who is exposed: ghost (npm) >= 6.56.0, < 6.67.0

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 8.8 high
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
ghostnpm>= 6.56.0, < 6.67.06.67.0

References

Original description

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. This issue is fixed in version 6.67.0.

Last activity 5 Oct 2026. Patch Forecast updates every hour.