What’s Vulnerable › Vulnerabilities
CVE-2026-29053: Ghost Vulnerable to Remote Code Execution via Malicious Themes
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 4.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-03-05 · updated 2026-06-17
- Weakness: CWE-74
Description
Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.
Affected products
- TryGhost Ghost: from 0.7.2 before 6.19.1 — fixed in 6.19.1
How to fix
Upgrade to a fixed version: TryGhost Ghost 6.19.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-29053 or the next vulnerability affects your stack