CVE-2026-105645 · GHSA-9m4w-fmjw-fvjq
Ghost: Regular Expression Denial of Service in External Media Inliner
- Risk score
- 40/100
- CVSS
- 4.9 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.
- Affected
- ghost (npm) >= 5.37.0, < 6.67.0
- Fix
- Upgrade ghost to 6.67.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
ghost: Amber, patch this week. Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the…
The flaws
- CVE-2026-105645: Ghost: Regular Expression Denial of Service in External Media Inliner (CVSS 4.9 · EPSS 0%)
- CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images (CVSS 8.8 · EPSS 0%)
- CVE-2026-105650: Ghost: Stored XSS via oEmbed Photo Responses (CVSS 8.1 · EPSS 0%)
- CVE-2026-105677: Ghost: Remote Code Execution via Theme Translation Files (CVSS 7.2 · EPSS 1%)
The fix
Upgrade ghost: 6.67.0 · 6.64.0 or later on your release line
Who is exposed: ghost (npm) >= 6.56.0, < 6.67.0
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-1333 (CWE-1333). 46 other warnings in 30 days
Why it is Yellow
- CVSS 4.9 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| ghost | npm | >= 5.37.0, < 6.67.0 | 6.67.0 |
References
- https://github.com/advisories/GHSA-9m4w-fmjw-fvjq
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-9m4w-fmjw-fvjq
- https://nvd.nist.gov/vuln/detail/CVE-2026-105645
- https://github.com/TryGhost/Ghost/issues/31058
- https://github.com/TryGhost/Ghost/pull/31058
- https://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce
- https://github.com/TryGhost/Ghost/releases/tag/v6.66.0
- https://github.com/advisories/GHSA-9m4w-fmjw-fvjq
Original description
Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.
Last activity 5 Oct 2026. Patch Forecast updates every hour.