CVE-2026-103277 in Ghost
Summary
by MITRE • 10/01/2026
Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially compromising administrative access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The Ghost platform, specifically versions ranging from 2.5.0 up to but not including 6.34.0, contains a critical security flaw within its oEmbed preview functionality that allows for the execution of untrusted scripts in an elevated context. This vulnerability stems from a failure to properly sandbox or isolate external content when rendering previews for embedded media. The oEmbed protocol is designed to allow websites to display rich embeds such as videos and tweets by fetching metadata from third-party providers. However, Ghost's implementation historically allowed these externally hosted scripts to execute directly within the browser context of the user viewing the preview, rather than in a restricted environment like an iframe with strict content security policies or sandbox attributes. This architectural oversight creates a significant attack surface for cross-site scripting attacks targeting administrative users.
The technical nature of this flaw is classified as CWE-79, which refers to Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting. In this specific instance, the vulnerability manifests as an untrusted script execution issue where the application fails to validate or sanitize the content retrieved from external oEmbed providers before rendering it in the admin interface. When a staff member with administrative privileges views a post containing maliciously crafted oEmbed data, the browser executes the embedded scripts as if they originated from Ghost itself. This bypasses standard same-origin policies because the script runs within the trusted domain of the Ghost administration panel, granting the attacker full access to the DOM and session cookies associated with that admin account.
The operational impact of this vulnerability is severe due to its potential for privilege escalation. An attacker does not need direct login credentials; instead, they can craft a malicious oEmbed payload and distribute it through various channels such as blog posts, social media links, or email newsletters. When an administrator clicks on the link or views the post in their dashboard, the malicious script executes automatically. This allows the attacker to hijack the admin session by stealing authentication tokens or cookies, performing actions on behalf of the administrator, creating new administrative accounts, exfiltrating sensitive data, or defacing the website content. The risk is amplified because many Ghost installations rely heavily on user-generated content and external integrations, making it likely that administrators will encounter such embedded links during routine management tasks.
This vulnerability aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically under sub-techniques involving JavaScript execution in a web browser context. It also relates to T1078, Valid Accounts, as the exploitation leads to unauthorized access using legitimate administrative credentials obtained through session hijacking. The lack of sandboxing means that even if Content Security Policy headers are configured on the main site, they may not apply effectively within the dynamic preview rendering engine used for oEmbed content, leaving a gap in defense-in-depth strategies.
To mitigate this risk, organizations running Ghost versions prior to 6.34.0 must upgrade immediately to version 6.34.0 or later where these sandboxing mechanisms have been implemented and external scripts are properly isolated. For environments that cannot be upgraded instantly, temporary mitigations include disabling the oEmbed preview feature if it is not strictly necessary for operations. Additionally, implementing strict Content Security Policy headers that restrict script execution to trusted sources can help reduce the impact, although this may interfere with legitimate functionality. Monitoring admin logs for unusual activity or unauthorized changes can also aid in early detection of exploitation attempts. Regular security audits and penetration testing focused on input validation and output encoding practices are recommended to prevent similar vulnerabilities in future updates.