Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-105649 · GHSA-8575-cr6v-7jh4

Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Risk score
53/100
CVSS
7.3 v3.1
Exploit chance (30 days)
0.3%
Published
5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff…
Affected
ghost (npm) >= 4.22.0, < 6.65.0
Fix
Upgrade ghost to 6.65.0 or later.
Exploitation
No known exploitation

Story map

Story map: ghostTHE FLAWSTHE FIXCVE-2026-105649Ghost: Stored XSS via SVGUploads Bypassing SanitizationCVSS 7.3 · EPSS 0%CVE-2026-105642Ghost: Remote Code Executionvia Bookmark Card ImagesCVSS 8.8 · EPSS 0%CVE-2026-105650Ghost: Stored XSS via oEmbedPhoto ResponsesCVSS 8.1 · EPSS 0%CVE-2026-105677Ghost: Remote Code Executionvia Theme Translation FilesCVSS 7.2 · EPSS 1%Upgrade ghost6.65.0 · 6.67.0 · 6.64.0or later on your release lineWho is exposedghost (npm) >= 6.56.0, < 6.67.0AMBER · PATCH THIS WEEKghostGhost is a Node.js contentmanagement system. From6.56.0 until 6.67.0, an imageprocessing library bundled withGhost contained a vulnerabilityin its SVG handling. Any staffuser, including Contributors…Where it standsNo known exploitationCONNECTS TOSame weaknessCross-site scripting (CWE-79)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

ghost: Amber, patch this week. Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the…

The flaws

  • CVE-2026-105649: Ghost: Stored XSS via SVG Uploads Bypassing Sanitization (CVSS 7.3 · EPSS 0%)
  • CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images (CVSS 8.8 · EPSS 0%)
  • CVE-2026-105650: Ghost: Stored XSS via oEmbed Photo Responses (CVSS 8.1 · EPSS 0%)
  • CVE-2026-105677: Ghost: Remote Code Execution via Theme Translation Files (CVSS 7.2 · EPSS 1%)

The fix

Upgrade ghost: 6.65.0 · 6.67.0 · 6.64.0 or later on your release line

Who is exposed: ghost (npm) >= 6.56.0, < 6.67.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.3 high
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
ghostnpm>= 4.22.0, < 6.65.06.65.0

References

Original description

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.65.0.

Last activity 5 Oct 2026. Patch Forecast updates every hour.