Ghost EUVD-2026-39019

Exploitation requires that the attacker control a maliciously customized ActivityPub server and that the victim Ghost instance (prior to 3.1.0) federate with or consume posts from that server - federation must be enabled and the victim must follow/receive the attacker's content. The victim user must then actively view the malicious shared post for the injected JavaScript to execute (UI:R in the CVSS vector). Limiting factors: the required attacker-operated federation peer and the high attack complexity (AC:H), the necessity of user interaction, and the fact that instances which do not enable ActivityPub federation or only federate with trusted servers are not realistically exposed. No target-side authentication is needed by the attacker (PR:N), but the practical barrier is establishing the federation relationship and getting the victim to render the content.

The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. Two metrics meaningfully constrain real-world risk: AC:H reflects that the attacker must operate a maliciously customized ActivityPub server and have the victim instance federate with it, and UI:R requires the victim to actually view the malicious post. No EPSS score was provided, so exploitation probability cannot be quantified; the vulnerability is not in CISA KEV and no POC was supplied, so there is no evidence of active or automated exploitation. The C:H/I:H/A:H impact ratings are aggressive for a client-side XSS and likely reflect a worst-case account-takeover assumption rather than confirmed availability impact - XSS typically does not degrade availability, so the A:H rating should be treated with skepticism pending vendor detail. Net assessment: a credible but conditional risk - meaningful for instances that federate broadly with untrusted servers, lower priority for closed or tightly controlled federation, and not an emergency-patch scenario absent exploitation signals. SSVC inputs (automatable, exploitation status) were not provided in the input data.

An attacker stands up or customizes an ActivityPub server and crafts a post containing embedded JavaScript, then ensures a victim Ghost instance federates with or follows that server. When a Ghost user opens or views the shared malicious post in the ActivityPub client, the injected script runs in their authenticated browser session, potentially exfiltrating session tokens or performing actions as that user. No public POC was provided, and the attack depends on the victim viewing the content (UI:R) and the relatively involved setup of a malicious federation peer (AC:H).