CVE-2026-105651: Ghost: Stored XSS via Bookmark Card Images

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-05 · updated 2026-10-07
Weakness: CWE-79

Description

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0.

Affected products

TryGhost Ghost: from 5.94.0, < 6.64.0

References

https://github.com/TryGhost/Ghost/commit/b41fe3f2c399cef058e6b487782a0b2263e86c03
https://github.com/TryGhost/Ghost/issues/30761
https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
https://github.com/TryGhost/Ghost/security/advisories/GHSA-347q-26qq-h2p6

Get alerted when CVE-2026-105651 or the next vulnerability affects your stack