EUVD-2026-39020
GHSA-jx35-x7fj-vgpr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Public API target gives AV:N and PR:N; brute-force enumeration raises AC slightly but L is defensible given no special preconditions; C:L reflects partial private-field disclosure without full system confidentiality loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes' case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. This vulnerability is fixed in 6.21.2.
AnalysisAI
Filter validation bypass in Ghost CMS public API endpoints exposes private fields - including password hashes - to unauthenticated remote attackers via repeated brute-force probing. Instances running SQLite are most severely impacted: full password hashes are recoverable, enabling offline cracking. MySQL-backed instances leak structurally degraded hashes (case information lost), which the vendor assesses would render subsequent cracking attempts fruitless. No public exploit code exists and the vulnerability is not in CISA KEV at time of analysis, but the unauthenticated, network-accessible nature of the flaw lowers the bar for opportunistic discovery.
Technical ContextAI
Ghost is an open-source Node.js content management system (CPE: cpe:2.3:a:tryghost:ghost:*:*:*:*:*:*:*:*) widely used for developer blogs, newsletters, and creator publishing platforms. The vulnerability stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the public-facing REST API exposes a filter parameter meant to query published content, but input validation on that filter can be partially circumvented. By crafting filter expressions that reference private model fields - fields that should be inaccessible to unauthenticated callers - an attacker can iteratively probe field values through differential responses (a filter oracle or enumeration side-channel). The severity of the resulting data leakage depends on the configured database backend: SQLite stores password hashes verbatim and they are fully recoverable this way, while MySQL normalizes string case before storage, degrading the extracted hash and largely defeating downstream cracking.
RemediationAI
Upgrade to Ghost 6.21.2 or later, which is the vendor-confirmed patched release per the GitHub Security Advisory at https://github.com/TryGhost/Ghost/security/advisories/GHSA-jx35-x7fj-vgpr. No workarounds are documented in the available advisory data. For operators unable to patch immediately, consider rate-limiting or IP-allowlisting access to the public API endpoints at the reverse-proxy or WAF layer to raise the cost of brute-force enumeration - note this is a detection and friction control, not a fix, and determined attackers with distributed infrastructure can still succeed. SQLite-backed deployments should treat an upgrade as urgent and consider invalidating all user sessions and forcing password resets post-patch in case hashes were already exfiltrated.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today