EUVD-2026-52928
GHSA-2gx6-7gx2-wwcf
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L
XSS requires a victim to render affected content (UI:R) and crosses the admin-to-browser security boundary (S:C); admin credentials are mandatory (PR:H); no availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1.
AnalysisAI
Cross-site scripting in Ghost CMS (versions 5.26.0 through 6.54.0) allows a high-privileged administrator to plant arbitrary JavaScript via the Universal Import feature, which fails to sanitize the feature_image_caption field and link card URLs before storing and rendering them. The fix in v6.54.1 introduces DOMPurify sanitization across both the Ember-based admin post history modal and the Node.js frontend rendering pipeline, alongside a strict URL protocol allowlist in the JSON-to-HTML importer. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept is known; the high-privilege prerequisite substantially limits the realistic attacker pool.
Technical ContextAI
Ghost is an open-source Node.js CMS distributed as the npm package ghost (CPE: cpe:2.3:a:tryghost:ghost:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) manifesting in two code paths: (1) the Ember-based Ghost Admin's post history modal (modal-post-history.js) rendered the feature_image_caption revision field without HTML sanitization, and (2) the frontend proxy service (proxy.js) wrapped the same field in a SafeString - bypassing Handlebars auto-escaping - without prior sanitization. A third path in json-to-html.js (the Universal Import JSON-to-HTML converter) failed to validate link card href URLs, permitting javascript: URIs and attribute injection. The patch adds DOMPurify server-side (via jsdom) with an allowlist restricted to tags a, b, i, span and attributes href, style, explicitly blocking data-* and aria-* attributes. URL validation was hardened with a getValidURL helper that enforces http: or https: protocols and uses a serializer to escape attribute values.
RemediationAI
Upgrade Ghost to v6.54.1 or later - this is the vendor-released patch confirmed by GHSA-2gx6-7gx2-wwcf and the GitHub release tag. Docker-based deployments should update the official Ghost image (https://hub.docker.com/_/ghost) following Ghost's Docker update guide at https://docs.ghost.org/install/docker#updating-ghost; Ghost-CLI installations should follow the update procedure at https://docs.ghost.org/update. If immediate upgrade is not feasible, the vendor advisory explicitly recommends disabling use of the Universal Import feature as the sole workaround - this eliminates the attack vector entirely but prevents content migration workflows that depend on bulk import. No other compensating controls are documented by the vendor, and no network-layer mitigation can substitute for sanitizing stored content already imported before patching.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today