Patch Forecast
Amber warning
Patch this week.

CVE-2026-105650 · GHSA-v3xr-g6p2-fvgv

Ghost: Stored XSS via oEmbed Photo Responses

Risk score
64/100
CVSS
8.1 v3.1
Exploit chance (30 days)
0.3%
Published
5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a …
Affected
ghost (npm) >= 2.5.0, < 6.64.0
Fix
Upgrade ghost to 6.64.0 or later.
Exploitation
No known exploitation

Story map

Story map: ghostTHE FLAWSTHE FIXCVE-2026-105650Ghost: Stored XSS via oEmbedPhoto ResponsesCVSS 8.1 · EPSS 0%CVE-2026-105642Ghost: Remote Code Executionvia Bookmark Card ImagesCVSS 8.8 · EPSS 0%CVE-2026-105677Ghost: Remote Code Executionvia Theme Translation FilesCVSS 7.2 · EPSS 1%CVE-2026-105675Ghost: Invite Token Disclosurein Ghost Admin APICVSS 7.5 · EPSS 0%Upgrade ghost6.64.0 · 6.67.0or later on your release lineWho is exposedghost (npm) >= 6.56.0, < 6.67.0AMBER · PATCH THIS WEEKghostGhost is a Node.js contentmanagement system. From6.56.0 until 6.67.0, an imageprocessing library bundled withGhost contained a vulnerabilityin its SVG handling. Any staffuser, including Contributors…Where it standsNo known exploitationCONNECTS TOSame weaknessCross-site scripting (CWE-79)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

ghost: Amber, patch this week. Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the…

The flaws

  • CVE-2026-105650: Ghost: Stored XSS via oEmbed Photo Responses (CVSS 8.1 · EPSS 0%)
  • CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images (CVSS 8.8 · EPSS 0%)
  • CVE-2026-105677: Ghost: Remote Code Execution via Theme Translation Files (CVSS 7.2 · EPSS 1%)
  • CVE-2026-105675: Ghost: Invite Token Disclosure in Ghost Admin API (CVSS 7.5 · EPSS 0%)

The fix

Upgrade ghost: 6.64.0 · 6.67.0 or later on your release line

Who is exposed: ghost (npm) >= 6.56.0, < 6.67.0

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 8.1 high
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
ghostnpm>= 2.5.0, < 6.64.06.64.0

References

Original description

Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. This issue is fixed in version 6.64.0.

Last activity 5 Oct 2026. Patch Forecast updates every hour.