GitHub Advisoryadvisory · npm

GHSA-9m84-wc28-w895 Ghost has incomplete CSRF protections around OTC use

HIGH Published 2026-03-05 Modified 2026-03-09 Official page ↗
Aliases
CVE-2026-29784
Ecosystem
npm
Packages
ghost
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2026-03-05

Affected packages

• npm ghost: >= 5.101.6, < 6.19.3 → fixed in 6.19.3

Description

Impact Incomplete CSRF protections around `/session/verify` made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site. Vulnerable versions This vulnerability is present in Ghost from v5.101.6 up to v6.19.2. Patches v6.19.3 contains a fix for this issue. How to update For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here. If a project's Ghost is a Ghost-CLI install see the documentation on updating it to the latest version here. For more information If there are any questions or comments about this advisory, send an email to [email protected].

Related

Alias · CVE (1)

  • CVE-2026-29784 Ghost is a Node.js content management system. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References