Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-105679 · GHSA-gfjp-2p8f-94qv

Ghost: Stored XSS via File Uploads on Local Storage

Risk score
52/100
CVSS
7.3 v3.1
Exploit chance (30 days)
0.2%
Published
5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a cont…
Affected
ghost (npm) >= 6.22.1, < 6.64.0
Fix
Upgrade ghost to 6.64.0 or later.
Exploitation
No known exploitation

Story map

Story map: ghostTHE FLAWSTHE FIXCVE-2026-105679Ghost: Stored XSS via FileUploads on Local StorageCVSS 7.3 · EPSS 0%CVE-2026-105642Ghost: Remote Code Executionvia Bookmark Card ImagesCVSS 8.8 · EPSS 0%CVE-2026-105650Ghost: Stored XSS via oEmbedPhoto ResponsesCVSS 8.1 · EPSS 0%CVE-2026-105677Ghost: Remote Code Executionvia Theme Translation FilesCVSS 7.2 · EPSS 1%Upgrade ghost6.64.0 · 6.67.0or later on your release lineWho is exposedghost (npm) >= 6.56.0, < 6.67.0AMBER · PATCH THIS WEEKghostGhost is a Node.js contentmanagement system. From6.56.0 until 6.67.0, an imageprocessing library bundled withGhost contained a vulnerabilityin its SVG handling. Any staffuser, including Contributors…Where it standsNo known exploitationCONNECTS TOSame weaknessCross-site scripting (CWE-79)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

ghost: Amber, patch this week. Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the…

The flaws

  • CVE-2026-105679: Ghost: Stored XSS via File Uploads on Local Storage (CVSS 7.3 · EPSS 0%)
  • CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images (CVSS 8.8 · EPSS 0%)
  • CVE-2026-105650: Ghost: Stored XSS via oEmbed Photo Responses (CVSS 8.1 · EPSS 0%)
  • CVE-2026-105677: Ghost: Remote Code Execution via Theme Translation Files (CVSS 7.2 · EPSS 1%)

The fix

Upgrade ghost: 6.64.0 · 6.67.0 or later on your release line

Who is exposed: ghost (npm) >= 6.56.0, < 6.67.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.3 high
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
ghostnpm>= 6.22.1, < 6.64.06.64.0

References

Original description

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file extension. This could be used to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0.

Last activity 5 Oct 2026. Patch Forecast updates every hour.