Ghost EUVD-2026-90670

Exploitation requires that the target Ghost instance expose the oEmbed preview feature in the admin editor (default behavior) and that a staff/admin user actually previews or inserts the attacker-crafted oEmbed content - this is the UI:P requirement. The attacker needs no authentication (PR:N) to craft and host the malicious oEmbed response, but the payload only executes in the victim's authenticated admin browser session when that staff user renders the preview. Instances on 6.34.0 or later are not affected; the window is limited to versions 2.5.0 through pre-6.34.0. The practical limiter is the need for a privileged user to interact with attacker-controlled embed content.

This is a genuinely notable XSS/untrusted-script-execution flaw, but the raw CVSS 4.0 score of 8.6 slightly overstates the real-world urgency given the missing exploitation signals. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N) indicates a remote, unauthenticated, low-complexity attacker whose payload executes with high confidentiality and integrity impact - consistent with an admin-session takeover via malicious oEmbed content. The UI:P (passive user interaction) metric is the key limiter: the attack only lands when a staff user previews/renders the attacker's crafted oEmbed content in the admin editor, so it is not a server-side RCE fired at will. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so this is best treated as 'no public exploit identified at time of analysis' - a patched-but-not-yet-weaponized issue rather than confirmed active exploitation. A patch is confirmed available from the vendor (6.34.0). Net: a real priority for any Ghost instance with multiple/untrusted content contributors, but the dependency on staff interaction and absence of exploitation evidence places it below drop-everything KEV-tier issues.

An attacker crafts a malicious oEmbed-providing URL (or content) whose preview response references externally hosted, unsandboxed JavaScript. When a Ghost staff user pastes or previews that embed in the admin editor, the untrusted script executes within the authenticated admin session, letting the attacker steal session context and pivot to administrative actions. No public exploit code is identified at time of analysis, and success depends on a staff user actually previewing the crafted embed (UI:P).