CVE-2026-105650 in Ghost
Summary
by MITRE • 10/06/2026
Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session. This issue is fixed in version 6.64.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified as CVE-2023-5871 affects Ghost, an open-source Node.js content management system widely used for blogging and publishing platforms. The flaw exists within the URL embedding functionality present in versions ranging from 2.1.0 through 6.64.0. This security issue stems from insufficient sanitization of user-supplied input when processing URLs embedded by authors or editors into post content. Specifically, if an attacker controls a website linked via such an embed, they can inject malicious scripts that are subsequently stored within the CMS database rather than being executed immediately in the browser context during initial rendering. This behavior deviates from secure defaults where untrusted HTML should be strictly sanitized to prevent script injection.
The technical mechanism of this flaw allows for Stored Cross-Site Scripting, commonly referred to as XSS. When a user embeds content from an external source controlled by an adversary, the system fails to adequately strip or neutralize executable JavaScript code contained within that embedded data structure. Consequently, these scripts become part of the persistent content stored in the backend database. This persistence is critical because it ensures that every time the affected post is accessed, viewed, or processed, the malicious payload remains present and ready for execution under specific conditions defined by the application's rendering pipeline.
The operational impact of this vulnerability is severe due to its multi-vector nature. The injected scripts are not limited to a single interface but propagate across three distinct attack surfaces within the Ghost ecosystem: the administrative editor, the public-facing published site, and automated newsletter emails sent to subscribers. In the admin editor context, staff users viewing or editing posts containing the malicious embed will trigger script execution in their browser session while authenticated as administrators. This scenario poses a direct risk of compromising the administrator's active session tokens, cookies, or authentication credentials. Attackers can leverage this access to perform unauthorized actions such as creating new administrative accounts, modifying site settings, exfiltrating sensitive data, or defacing the website content.
Furthermore, the vulnerability extends beyond immediate admin compromise by affecting end-users and subscribers. When the compromised post is published on the public-facing site, any visitor viewing it may have their browser execute the malicious scripts. This can lead to session hijacking for regular users, credential theft via phishing overlays injected into legitimate forms, or redirection to malware distribution sites. Additionally, because Ghost automatically generates newsletter emails based on new posts, subscribers receiving these newsletters will also be exposed if their email clients render HTML content and allow script execution, although modern email clients typically block active scripts. However, the risk remains significant for admin sessions accessed through the web interface.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. The persistence of the payload in the database classifies it specifically under Stored XSS rather than Reflected XSS. In terms of adversary tactics and techniques, this exploit maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, with a specific focus on JavaScript execution within web browsers. It also relates to T1078, Valid Accounts, as the ultimate goal is often to gain persistent access through compromised administrative credentials.
Mitigation strategies primarily involve upgrading the Ghost installation to version 6.64.0 or later, where this input validation and sanitization logic has been corrected. For organizations unable to upgrade immediately due to compatibility constraints with custom themes or integrations, temporary mitigations include implementing a Web Application Firewall rule that detects and blocks requests containing suspicious script tags within URL parameters or embed data structures. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact by restricting where scripts are allowed to execute, although this is not a substitute for fixing the root cause in the application code. Regular security audits of third-party integrations and careful review of user-generated content workflows are also recommended to prevent similar vulnerabilities from being introduced through other vectors.