CVE-2026-105651 · GHSA-347q-26qq-h2p6
Ghost: Stored XSS via Bookmark Card Images
- Risk score
- 53/100
- CVSS
- 7.3 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting…
- Affected
- ghost (npm) >= 5.94.0, < 6.64.0
- Fix
- Upgrade ghost to 6.64.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
ghost: Amber, patch this week. Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the…
The flaws
- CVE-2026-105651: Ghost: Stored XSS via Bookmark Card Images (CVSS 7.3 · EPSS 0%)
- CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images (CVSS 8.8 · EPSS 0%)
- CVE-2026-105650: Ghost: Stored XSS via oEmbed Photo Responses (CVSS 8.1 · EPSS 0%)
- CVE-2026-105677: Ghost: Remote Code Execution via Theme Translation Files (CVSS 7.2 · EPSS 1%)
The fix
Upgrade ghost: 6.64.0 · 6.67.0 or later on your release line
Who is exposed: ghost (npm) >= 6.56.0, < 6.67.0
Where it stands
- No known exploitation
Connects to
- Same weakness: Cross-site scripting (CWE-79). 399 other warnings in 30 days
Why it is Yellow
- CVSS 7.3 high
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| ghost | npm | >= 5.94.0, < 6.64.0 | 6.64.0 |
References
- https://github.com/advisories/GHSA-347q-26qq-h2p6
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-347q-26qq-h2p6
- https://nvd.nist.gov/vuln/detail/CVE-2026-105651
- https://github.com/TryGhost/Ghost/issues/30761
- https://github.com/TryGhost/Ghost/pull/30761
- https://github.com/TryGhost/Ghost/commit/b41fe3f2c399cef058e6b487782a0b2263e86c03
- https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
- https://github.com/advisories/GHSA-347q-26qq-h2p6
Original description
Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0.
Last activity 5 Oct 2026. Patch Forecast updates every hour.