CVE-2026-103277: Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-01
Weakness: CWE-79

Description

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially compromising administrative access.

Affected products

TryGhost Ghost: from 2.5.0 before 6.34.0 — fixed in 6.34.0

How to fix

Upgrade to a fixed version: TryGhost Ghost 6.34.0. Check the vendor advisory for mitigations.

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-8vhf-xxpj-4qrg
https://www.vulncheck.com/advisories/ghost-2.5.0-before-6.34.0-untrusted-script-execution-via-oembed

Get alerted when CVE-2026-103277 or the next vulnerability affects your stack