Go to packages list

ghost

Ecosystem: npm

Downloads: 83.53 K

Vulnerabilities from the last (months)
  • 4CriticalAffects 4 versions
  • 17HighAffects 21 versions
  • 0MediumAffects 0 versions
  • 39ModerateAffects 44 versions
  • 3LowAffects 3 versions
Severity distribution (all time)
63vulnerabilities
  • Critical4 (6.3%)
  • High17 (27.0%)
  • Medium0 (0.0%)
  • Moderate39 (61.9%)
  • Low3 (4.8%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 22 vulnerabilities
    • Critical: 0
    • High: 9
    • Medium: 0
    • Moderate: 10
    • Low: 3
  • 16 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 16
    • Low: 0
  • 1 vulnerabilities
    • Critical: 1
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 2 vulnerabilities
    • Critical: 0
    • High: 2
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 1
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 5 vulnerabilities
    • Critical: 0
    • High: 3
    • Medium: 0
    • Moderate: 2
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 2 vulnerabilities
    • Critical: 0
    • High: 2
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 2 vulnerabilities
    • Critical: 2
    • High: 0
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 2 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 2
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0

Vulnerabilities (63)

Known vulnerabilities affecting ghost, based on data from OSV.

Vulnerabilities affecting ghost
IDSeveritySummaryAffected versionsPublishedSource
GHSA-qrh6-cwg3-343xModerateGhost: Authorization Bypass in Comment Like Feature### Impact An input validation issue allowed members to delete comment likes / dislikes that they were not authorized to delete. ### Vulnerable versions This vulnerability is present in Ghost from v5.9.0 up to v6.44.1. ### Patches v6.44.1 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI install see our documentation on [updating it to the l
  • >= 5.9.0, < 6.44.1
GitHub (opens in a new tab)
GHSA-322m-ff4g-9vx9ModerateGhost: Server-Side Request Forgery in Bookmark Fetching### Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. ### Vulnerable versions This vulnerability is present in Ghost from v6.54.1 up to v6.64.0. ### Patches v6.65.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented h
  • >= 6.54.1, < 6.65.0
GitHub (opens in a new tab)
GHSA-347q-26qq-h2p6HighGhost: Stored XSS via Bookmark Card Images### Impact When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin sessions. ### Vulnerable versions This vulnerability is present in Ghost from v5.94.0 up to v6.64.0. ### Patches v6.64.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docke
  • >= 5.94.0, < 6.64.0
GitHub (opens in a new tab)
GHSA-354h-gmhv-mr9cLowGhost: Server-Side Request Forgery in Webhook Trigger### Impact An SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. ### Vulnerable versions This vulnerability is present in Ghost from v1.18.0 up to v6.27.0. ### Patches v6.27.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI install see our documentation on [updating it to the late
  • >= 1.18.0, < 6.27.0
GitHub (opens in a new tab)
GHSA-4pvx-fwjj-8gpcModerateGhost: Editors Could Promote Staff Users to Their Own Role### Impact Staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. ### Vulnerable versions This vulnerability is present in Ghost from v0.5.0 up to v6.64.0. ### Patches v6.64.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI ins
  • >= 0.5.0, < 6.64.0
GitHub (opens in a new tab)
GHSA-53vv-xm9f-mm82LowGhost: Password Hash Ordering Disclosure in Ghost Admin API### Impact Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. ### Vulnerable versions This vulnerability is present in Ghost from v0.7.2 up to v6.64.0. ### Patches v6.64.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#u
  • >= 0.7.2, < 6.64.0
GitHub (opens in a new tab)
GHSA-69qc-f5m6-889cHighGhost: Stored XSS via Embed Card Previews### Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, possibly resulting in compromise of that user's admin session. Self-hosted sites should leave the new `security.embedPreviewUrl` config option at its default. ### Vulnerable versions This vulnerability is present in Ghost from v6.34.0 up to v6.65.0. ### Patches v6.67.0 contains a fix for this issue. ### How to update For self-hosters using Docker, f
  • >= 6.34.0, < 6.67.0
GitHub (opens in a new tab)
GHSA-6q6j-f24j-p477ModerateGhost: Authorization Bypass in Comments Feature### Impact An input validation issue allowed members to access comments they were not authorized to access. ### Vulnerable versions This vulnerability is present in Ghost from v5.9.0 up to v6.44.1. ### Patches v6.44.1 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](h
  • >= 5.9.0, < 6.44.1
GitHub (opens in a new tab)
GHSA-788w-68h3-cvxpHighGhost: Remote Code Execution via Bookmark Card Images### Impact An image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. ### Vulnerable versions This vulnerability is present in Ghost from v6.56.0 up to v6.65.0. ### Patches v6.67.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented
  • >= 6.56.0, < 6.67.0
GitHub (opens in a new tab)
GHSA-83rp-q473-j88cLowGhost: Path Traversal Vulnerability in Ghost ImageSize Service### Impact An input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. ### Vulnerable versions This vulnerability is present in Ghost from v6.14.0 up to v6.27.0. ### Patches v6.27.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI install see our documentation on
  • >= 6.14.0, < 6.27.0
GitHub (opens in a new tab)
  • GHSA-qrh6-cwg3-343xModerate
    Ghost: Authorization Bypass in Comment Like Feature
    • >= 5.9.0, < 6.44.1
    GitHub (opens in a new tab)

    ### Impact An input validation issue allowed members to delete comment likes / dislikes that they were not authorized to delete. ### Vulnerable versions This vulnerability is present in Ghost from v5.9.0 up to v6.44.1. ### Patches v6.44.1 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI install see our documentation on [updating it to the l

    CVE: CVE-2026-103288

  • GHSA-322m-ff4g-9vx9Moderate
    Ghost: Server-Side Request Forgery in Bookmark Fetching
    • >= 6.54.1, < 6.65.0
    GitHub (opens in a new tab)

    ### Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. ### Vulnerable versions This vulnerability is present in Ghost from v6.54.1 up to v6.64.0. ### Patches v6.65.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented h

    CVE: CVE-2026-105647

  • GHSA-347q-26qq-h2p6High
    Ghost: Stored XSS via Bookmark Card Images
    • >= 5.94.0, < 6.64.0
    GitHub (opens in a new tab)

    ### Impact When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin sessions. ### Vulnerable versions This vulnerability is present in Ghost from v5.94.0 up to v6.64.0. ### Patches v6.64.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docke

    CVE: CVE-2026-104413

  • GHSA-354h-gmhv-mr9cLow
    Ghost: Server-Side Request Forgery in Webhook Trigger
    • >= 1.18.0, < 6.27.0
    GitHub (opens in a new tab)

    ### Impact An SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. ### Vulnerable versions This vulnerability is present in Ghost from v1.18.0 up to v6.27.0. ### Patches v6.27.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI install see our documentation on [updating it to the late

    CVE: CVE-2026-103287

  • GHSA-4pvx-fwjj-8gpcModerate
    Ghost: Editors Could Promote Staff Users to Their Own Role
    • >= 0.5.0, < 6.64.0
    GitHub (opens in a new tab)

    ### Impact Staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. ### Vulnerable versions This vulnerability is present in Ghost from v0.5.0 up to v6.64.0. ### Patches v6.64.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI ins

    CVE: CVE-2026-104412

  • GHSA-53vv-xm9f-mm82Low
    Ghost: Password Hash Ordering Disclosure in Ghost Admin API
    • >= 0.7.2, < 6.64.0
    GitHub (opens in a new tab)

    ### Impact Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. ### Vulnerable versions This vulnerability is present in Ghost from v0.7.2 up to v6.64.0. ### Patches v6.64.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#u

    CVE: CVE-2026-104415

  • GHSA-69qc-f5m6-889cHigh
    Ghost: Stored XSS via Embed Card Previews
    • >= 6.34.0, < 6.67.0
    GitHub (opens in a new tab)

    ### Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, possibly resulting in compromise of that user's admin session. Self-hosted sites should leave the new `security.embedPreviewUrl` config option at its default. ### Vulnerable versions This vulnerability is present in Ghost from v6.34.0 up to v6.65.0. ### Patches v6.67.0 contains a fix for this issue. ### How to update For self-hosters using Docker, f

    CVE: CVE-2026-105643

  • GHSA-6q6j-f24j-p477Moderate
    Ghost: Authorization Bypass in Comments Feature
    • >= 5.9.0, < 6.44.1
    GitHub (opens in a new tab)

    ### Impact An input validation issue allowed members to access comments they were not authorized to access. ### Vulnerable versions This vulnerability is present in Ghost from v5.9.0 up to v6.44.1. ### Patches v6.44.1 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](h

    CVE: CVE-2026-103289

  • GHSA-788w-68h3-cvxpHigh
    Ghost: Remote Code Execution via Bookmark Card Images
    • >= 6.56.0, < 6.67.0
    GitHub (opens in a new tab)

    ### Impact An image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. ### Vulnerable versions This vulnerability is present in Ghost from v6.56.0 up to v6.65.0. ### Patches v6.67.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented

    CVE: CVE-2026-105642

  • GHSA-83rp-q473-j88cLow
    Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
    • >= 6.14.0, < 6.27.0
    GitHub (opens in a new tab)

    ### Impact An input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. ### Vulnerable versions This vulnerability is present in Ghost from v6.14.0 up to v6.27.0. ### Patches v6.27.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI install see our documentation on

    CVE: CVE-2026-103290

Showing 1-10 of 63 vulnerabilities