GitHub Advisoryadvisory · npm

GHSA-xpp7-93x6-v29m XSS in Ghost's ActivityPub client

HIGH Published 2026-08-04 Modified 2026-08-04 Official page ↗
Aliases
CVE-2026-53950
Ecosystem
npm
Packages
@tryghost/activitypub
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2026-08-04

Affected packages

• npm @tryghost/activitypub: < 3.1.0 → fixed in 3.1.0

Description

Impact The ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. Vulnerable Versions This vulnerability is present in the @tryghost/activitypub package up to v3.0.8. All prior versions are also affected. Patches @tryghost/activitypub v3.1.0 contains a fix for this issue and is also automatically fetched by Ghost. References Ghost thanks Brad Geesaman, Ghost Security for disclosing this vulnerability responsibly. For more information If you have any questions or comments about this advisory, email Ghost at [email protected].

Related

Alias · CVE (1)

  • CVE-2026-53950 @tryghost/activitypub is Ghost’s social/federation client app. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References