GHSA-w52v-v783-gw97 Ghost has a SQL injection in Content API

• npm ghost: >= 3.24.0, < 6.19.1 → fixed in 6.19.1

Impact A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database. Vulnerable Versions This vulnerability is present in Ghost v3.24.0 to v6.19.0. Patches v6.19.1 contains a fix for this issue. Note: as this vulnerability lets an attacker gain access to a site's API keys, we recommend reviewing staff users and rotating keys. We generally recommend always updating Ghost to its most current version. Workarounds There is no application-level workaround. The Content API key is public by design, so restricting key access does not mitigate this vulnerability. As a temporary mitigation, a reverse proxy or WAF rule can be used to block Content API requests containing `slug%3A%5B` or `slug:` in the query string filter parameter. Note that this may break legitimate slug filter functionality. References We thank Nicholas Carlini using Claude, Anthropic for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email us at [[email protected].