Ghost CMS CVE-2026-105650

Exploitation requires an authenticated Ghost staff user (someone able to create/edit posts) to actively embed a URL pointing to an attacker-controlled website; that site must expose a self-declared oEmbed endpoint returning a 'photo', 'rich', or 'video' type response carrying an html field containing script. Affected versions are 2.1.0 through 6.63.x (fixed in 6.64.0). Limiting factors that reduce real-world risk: the required staff-user interaction (UI:R) means the attack cannot be triggered remotely without a victim embedding the malicious link; established providers (YouTube, Twitter, etc.) are unaffected because they pass through @extractus/oembed-extractor's allowlist, so only non-allowlisted, arbitrary endpoints reach the vulnerable path; and impact escalates (to published-site visitors and newsletter recipients) only once the poisoned content is published or sent.

Signals point to a genuine but conditional threat rather than a mass-exploitation emergency. The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), driven by network reach, low complexity, no attacker privileges, and high confidentiality/integrity impact - but the UI:R metric is decisive: a logged-in Ghost staff user must actively embed an attacker-controlled URL for the stored XSS to land. This is a stored/second-order XSS (CWE-79) whose payload subsequently executes in the admin editor, the public site, and newsletter emails, so a single successful injection can reach many victims, which realistically argues for a scope change the NVD vector does not reflect. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no evidence of active or automated exploitation; the GitHub security advisory and fix commit do disclose the mechanism and a representative payload (<img src=x onerror=...>), which lowers the bar for a researcher to reproduce it. SSVC inputs (exploitation status, automatability, technical impact) were not supplied. Net: a real priority for Ghost operators to patch promptly because the impact is admin-session compromise, but the mandatory staff-user interaction and the absence of KEV/EPSS/POC signals make widespread opportunistic exploitation unlikely - this is closer to a targeted social-engineering risk than a wormable internet-facing flaw.

An attacker stands up a website whose self-declared oEmbed endpoint returns a 'photo', 'rich', or 'video' response containing a malicious html field, then persuades a Ghost staff user to embed that URL in a post. When the post is opened in the editor, published to the public site, or sent as a newsletter, the stored script executes in those contexts and can hijack the staff user's admin session. No public exploit was identified, though the upstream fix commit and advisory disclose both the vulnerable code path and a sample onerror payload.