CVE-2026-104414 in Ghost
Summary
by MITRE • 10/02/2026
Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified within Ghost versions ranging from 2.5.0 to before 6.64.0 represents a significant security flaw classified as a stored cross-site scripting issue. This type of vulnerability is particularly dangerous because the malicious payload is persisted on the target server, ensuring that it executes for every user who views the affected content, rather than just the initial attacker or victim interacting with a specific link. The root cause lies in the improper validation and sanitization of input data received through oEmbed photo responses. When an administrator or editor attempts to embed media using an external URL via the oEmbed protocol, Ghost processes this request without adequately stripping out potentially executable JavaScript code embedded within the response metadata. This lack of rigorous output encoding allows untrusted scripts to be injected directly into post content during the editing process.
From a technical perspective, the flaw exploits the trust relationship between the application and its users by leveraging the oEmbed standard for photo embedding. When an attacker hosts a malicious oEmbed endpoint that returns crafted JSON or XML responses containing script tags or event handlers disguised as legitimate media metadata, Ghost’s parser accepts this data without sufficient sanitization. Consequently, when the post is saved in the editor, rendered on the published site, or included in newsletter emails sent to subscribers, the embedded scripts are executed within the context of the victim's browser session. This execution occurs with the privileges of the logged-in user if they are viewing the content while authenticated, thereby bypassing standard same-origin policy protections that would otherwise restrict script access to sensitive application data.
The operational impact of this vulnerability is severe due to its multi-vector nature and high-privilege potential. Because the malicious code persists in stored post content, it affects not only the Ghost editor interface but also the public-facing published site and automated newsletter distributions. For staff members with administrative privileges who view these posts while logged into the admin dashboard, the executed scripts can compromise their active sessions. This could lead to full account takeover, allowing attackers to modify website settings, create new administrator accounts, or exfiltrate sensitive data such as user credentials, API keys, and proprietary content. Furthermore, since newsletter emails often contain HTML versions of posts that are rendered in email clients with varying levels of security isolation, the attack surface extends to subscribers who may inadvertently trigger malicious actions if their client allows script execution, although the primary risk remains focused on authenticated staff sessions due to the higher value of those credentials.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under the stored variant where malicious scripts are permanently stored within target databases or content management systems. From a tactical perspective related to the MITRE ATT&CK framework, this behavior corresponds to techniques involving Client-side Injection and potentially Credential Access through Session Hijacking if the script successfully steals cookies or session tokens. The persistence mechanism ensures that the attack remains effective over time without requiring repeated exploitation attempts for each new victim who accesses the compromised content.
To mitigate this vulnerability, organizations running Ghost must upgrade immediately to version 6.64.0 or later where these input validation and output encoding issues have been addressed by the development team. Until an upgrade is feasible, administrators should exercise extreme caution when embedding external media via oEmbed, preferring direct file uploads over URL-based embeddings whenever possible to reduce exposure to untrusted third-party endpoints. Additionally, implementing a Content Security Policy with strict script-src directives can help mitigate the impact of any successfully injected scripts by restricting where JavaScript code is allowed to execute, although this should be viewed as a compensating control rather than a primary fix given that CSPs may interfere with legitimate application functionality in complex CMS environments like Ghost. Regular security audits and penetration testing focused on input validation across all user-facing endpoints are also recommended to identify similar weaknesses before they can be exploited by malicious actors seeking to compromise administrative accounts or disrupt service integrity.