GitHub Advisoryadvisory · npm

GHSA-cgc2-rcrh-qr5x Ghost Vulnerable to Remote Code Execution via Malicious Themes

HIGH Published 2026-03-03 Modified 2026-03-05 Official page ↗
Aliases
CVE-2026-29053
Ecosystem
npm
Packages
ghost
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2026-03-03

Affected packages

• npm ghost: >= 0.7.2, < 6.19.1 → fixed in 6.19.1

Description

Impact Specifically crafted malicious themes can execute arbitrary code on the server running Ghost. Vulnerable Versions This vulnerability is present in Ghost v0.7.2 to v6.19.0. Patches v6.19.1 contains a fix for this issue. Workarounds Ghost generally recommends users refrain from installing untrusted themes. If a malicious theme has already been installed, it is recommended to uninstall the theme and then inspect it to understand its impact, which will be attack-specific. References Ghost thanks Cristian-Alexandru Staicu at Endor Labs for disclosing this vulnerability responsibly. For more information If there are any questions or comments about this advisory, email Ghost at [email protected].

Related

Alias · CVE (1)

  • CVE-2026-29053 Ghost is a Node.js content management system. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References