ghost (npm)
Advisories
72
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 6.67.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install ghost@6.67.0yarn
yarn add ghost@6.67.0pnpm
pnpm add ghost@6.67.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-x3mg-q38v-m562 Ghost: Authorization Issue Allowed Author Role to Delete any Post |
Medium EPSS 0.27% |
>= 5.81.0, < 6.60.0 | 6.60.0 |
| GHSA-8575-cr6v-7jh4 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization |
High EPSS 0.30% |
>= 4.22.0, < 6.65.0 | 6.65.0 |
| GHSA-r7f2-6fj8-6fg2 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses |
Medium EPSS 0.30% |
>= 6.0.9, < 6.65.0 | 6.65.0 |
| GHSA-322m-ff4g-9vx9 Ghost: Server-Side Request Forgery in Bookmark Fetching |
Medium EPSS 0.24% |
>= 6.54.1, < 6.65.0 | 6.65.0 |
| GHSA-fwh9-qg68-vxp4 Ghost: Regular Expression Denial of Service in Content Import |
Medium EPSS 0.35% |
>= 4.0.0, < 6.67.0 | 6.67.0 |
| GHSA-9m4w-fmjw-fvjq Ghost: Regular Expression Denial of Service in External Media Inliner |
Medium EPSS 0.35% |
>= 5.37.0, < 6.67.0 | 6.67.0 |
| GHSA-hqq2-xqr2-fmx2 Ghost : Stored XSS via SVG Files in Content Imports |
Medium EPSS 0.32% |
>= 4.0.0, < 6.67.0 | 6.67.0 |
| GHSA-69qc-f5m6-889c Ghost: Stored XSS via Embed Card Previews |
High EPSS 0.28% |
>= 6.34.0, < 6.67.0 | 6.67.0 |
| GHSA-788w-68h3-cvxp Ghost: Remote Code Execution via Bookmark Card Images |
High EPSS 0.27% |
>= 6.56.0, < 6.67.0 | 6.67.0 |
| GHSA-jj74-hc2q-xrvm Ghost: Remote Code Execution via Theme Translation Files |
High EPSS 0.65% |
>= 6.10.3, < 6.64.0 | 6.64.0 |
| GHSA-m382-6jw4-fmp6 Ghost: Path Traversal via Locale Setting |
Medium EPSS 0.40% |
>= 1.20.0, < 6.64.0 | 6.64.0 |
| GHSA-v6q3-xqxm-6f5v Ghost: Invite Token Disclosure in Ghost Admin API |
High EPSS 0.40% |
>= 4.39.0, < 6.64.0 | 6.64.0 |
| GHSA-53vv-xm9f-mm82 Ghost: Password Hash Ordering Disclosure in Ghost Admin API |
Low EPSS 0.26% |
>= 0.7.2, < 6.64.0 | 6.64.0 |
| GHSA-v3xr-g6p2-fvgv Ghost: Stored XSS via oEmbed Photo Responses |
High EPSS 0.33% |
>= 2.5.0, < 6.64.0 | 6.64.0 |
| GHSA-347q-26qq-h2p6 Ghost: Stored XSS via Bookmark Card Images |
High EPSS 0.30% |
>= 5.94.0, < 6.64.0 | 6.64.0 |
| GHSA-4pvx-fwjj-8gpc Ghost: Editors Could Promote Staff Users to Their Own Role |
Medium EPSS 0.20% |
>= 0.5.0, < 6.64.0 | 6.64.0 |
| GHSA-gfjp-2p8f-94qv Ghost: Stored XSS via File Uploads on Local Storage |
High EPSS 0.26% |
>= 6.22.1, < 6.64.0 | 6.64.0 |
| GHSA-wj4w-mc24-pcfm Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature Withdrawn |
Medium | >= 5.9.0, < 6.44.1 | 6.44.1 |
| GHSA-83rp-q473-j88c Ghost: Path Traversal Vulnerability in Ghost ImageSize Service |
Medium EPSS 0.31% |
>= 6.14.0, < 6.27.0 | 6.27.0 |
| GHSA-6q6j-f24j-p477 Ghost: Authorization Bypass in Comments Feature |
High EPSS 0.26% |
>= 5.9.0, < 6.44.1 | 6.44.1 |
| GHSA-qrh6-cwg3-343x Ghost: Authorization Bypass in Comment Like Feature |
High EPSS 0.20% |
>= 5.9.0, < 6.44.1 | 6.44.1 |
| GHSA-354h-gmhv-mr9c Ghost: Server-Side Request Forgery in Webhook Trigger |
Medium EPSS 0.24% |
>= 1.18.0, < 6.27.0 | 6.27.0 |
| GHSA-pr22-p9rp-2cqv Ghost: Cross-Site Scripting in Feature Image Captions |
Medium EPSS 0.32% |
>= 4.9.0, < 6.54.1 | 6.54.1 |
| GHSA-x5mm-wm4g-j5xv Ghost: Server-Side Request Forgery Mitigation Issue |
Medium EPSS 0.28% |
>= 6.26.0, < 6.54.1 | 6.54.1 |
| GHSA-7mpp-r37j-x5wh Ghost: Session Fixation in Ghost Admin |
Medium EPSS 0.24% |
>= 2.2.0, < 6.54.1 | 6.54.1 |
| GHSA-cjc9-q5gf-327p Ghost: Theme Upload Path Traversal |
Medium EPSS 0.41% |
>= 0.10.0, < 6.54.1 | 6.54.1 |
| GHSA-cj62-hvv2-2q5h Ghost: Database Backup Path Traversal |
Medium EPSS 0.44% |
>= 1.20.1, < 6.54.1 | 6.54.1 |
| GHSA-gcvv-72q8-9v76 Ghost: Server-Side Request Forgery in Image Fetching |
Medium EPSS 0.37% |
>= 0.10.0, < 6.54.1 | 6.54.1 |
| GHSA-jm22-3w23-5q7w Ghost: Blind Password Hash Disclosure in Ghost Admin API |
Medium EPSS 0.32% |
< 6.54.1 | 6.54.1 |
| GHSA-4wx2-7gvj-qfq3 Ghost: Archived Offers can be Redeemed |
Medium EPSS 0.27% |
>= 4.22.0, < 6.54.1 | 6.54.1 |
| GHSA-2gx6-7gx2-wwcf Ghost: Cross-Site Scripting in Universal Import |
Medium EPSS 0.43% |
>= 5.26.0, < 6.54.1 | 6.54.1 |
| GHSA-xm43-3m56-w3wf Ghost: Paid gift memberships obtainable at minimal cost via the donations feature |
Medium EPSS 0.40% |
>= 6.27.0, < 6.44.0 | 6.44.0 |
| GHSA-jx35-x7fj-vgpr Ghost Content API filter bypass reveals private fields |
Medium EPSS 0.36% |
>= 5.46.1, < 6.21.2 | 6.21.2 |
| GHSA-944x-pm95-3jpr Ghost: File Upload Content-Type Spoofing |
Medium EPSS 0.23% |
>= 6.19.4, < 6.21.1 | 6.21.1 |
| GHSA-chgm-3698-jm42 Ghost: Member existence leak via magic link sign-in response |
Medium EPSS 0.34% |
>= 5.18.0, < 6.21.2 | 6.21.2 |
| GHSA-g366-23fw-ggp6 Ghost: Mobiledoc image-size fetch SSRF |
Medium EPSS 0.21% |
>= 6.19.4, < 6.21.2 | 6.21.2 |
| GHSA-ch52-px8q-f22j Ghost: Server-side request forgery via DNS rebinding in external request handling |
Medium EPSS 0.21% |
>= 6.0.9, < 6.21.2 | 6.21.2 |
| GHSA-wvp2-4qqp-4h3r Ghost: Private IP filtering bypass to make server-side requests to internal services |
Medium EPSS 0.33% |
>= 6.0.9, < 6.21.1 | 6.21.1 |
| GHSA-62q6-4hv4-vjrw Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header |
Critical EPSS 0.45% |
>= 4.0.0, < 6.37.0 | 6.37.0 |
| GHSA-9m84-wc28-w895 Ghost has incomplete CSRF protections around OTC use |
High EPSS 0.17% |
>= 5.101.6, < 6.19.3 | 6.19.3 |
| GHSA-cgc2-rcrh-qr5x Ghost Vulnerable to Remote Code Execution via Malicious Themes |
Critical EPSS 4.90% |
>= 0.7.2, < 6.19.1 | 6.19.1 |
| GHSA-w52v-v783-gw97 Ghost has a SQL injection in Content API |
High EPSS 71.09% |
>= 3.24.0, < 6.19.1 | 6.19.1 |
| GHSA-gv6q-2m97-882h Ghost vulnerable to XSS via malicious Portal preview links |
Medium EPSS 0.29% |
>= 6.0.0, < 6.15.0 | 6.15.0 |
| GHSA-gv6q-2m97-882h Ghost vulnerable to XSS via malicious Portal preview links |
Medium EPSS 0.29% |
>= 5.43.0, < 5.121.0 | 5.121.0 |
| GHSA-gjrp-xgmh-x9qq Ghost has SQL Injection in Members Activity Feed |
High EPSS 0.47% |
>= 5.105.0, < 5.130.6 | 5.130.6 |
| GHSA-gjrp-xgmh-x9qq Ghost has SQL Injection in Members Activity Feed |
High EPSS 0.47% |
>= 6.0.0, < 6.11.0 | 6.11.0 |
| GHSA-vmc4-9828-r48r Ghost has SSRF via External Media Inliner |
Low EPSS 0.30% |
>= 5.105.0, < 5.130.6 | 5.130.6 |
| GHSA-vmc4-9828-r48r Ghost has SSRF via External Media Inliner |
Low EPSS 0.30% |
>= 6.0.0, < 6.11.0 | 6.11.0 |
| GHSA-9xg7-mwmp-xmjx Ghost has Staff Token permission bypass |
High EPSS 0.54% |
>= 5.105.0, < 5.130.6 | 5.130.6 |
| GHSA-9xg7-mwmp-xmjx Ghost has Staff Token permission bypass |
High EPSS 0.54% |
>= 6.0.0, < 6.11.0 | 6.11.0 |
| GHSA-5fp7-g646-ccf4 Ghost has Staff 2FA bypass |
High EPSS 1.31% |
>= 5.105.0, < 5.130.6 | 5.130.6 |
| GHSA-5fp7-g646-ccf4 Ghost has Staff 2FA bypass |
High EPSS 1.31% |
>= 6.0.0, < 6.11.0 | 6.11.0 |
| GHSA-f7qg-xj45-w956 Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark |
Medium EPSS 0.52% |
>= 5.99.0, < 5.130.4 | 5.130.4 |
| GHSA-f7qg-xj45-w956 Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark |
Medium EPSS 0.52% |
>= 6.0.0, < 6.0.9 | 6.0.9 |
| GHSA-78x2-cwp9-5j42 Ghost's improper authentication allows access to member information and actions |
Medium EPSS 0.32% |
>= 4.46.0, < 5.89.5 | 5.89.5 |
| GHSA-99vc-xw8j-phjm Ghost has possible Cross-site Scripting issue |
Critical EPSS 3.48% |
<= 5.76.0 | No fix yet |
| GHSA-fh38-9fgr-454w Cross-site Scripting in Ghost |
Medium EPSS 0.44% |
< 5.76.0 | 5.76.0 |
| GHSA-9c9v-w225-v5rg Ghost vulnerable to arbitrary file read via symlinks in content import |
Medium EPSS 68.95% |
< 5.59.1 | 5.59.1 |
| GHSA-wf7x-fh6w-34r6 Path Traversal in Ghost |
High EPSS 39.08% |
< 5.42.1 | 5.42.1 |
| GHSA-r97q-ghch-82j9 Ghost vulnerable to information disclosure of private API fields |
High EPSS 45.71% |
< 5.46.1 | 5.46.1 |
| GHSA-9gh8-wp53-ccc6 ghost vulnerable to unauthorized newsletter modification via improper access controls |
Medium EPSS 18.91% |
>= 5.0.0, < 5.22.7 | 5.22.7 |
| GHSA-9gh8-wp53-ccc6 ghost vulnerable to unauthorized newsletter modification via improper access controls |
Medium EPSS 18.91% |
>= 4.46.0, < 4.48.8 | 4.48.8 |
| GHSA-7v28-g2pq-ggg8 Ghost vulnerable to remote code execution in locale setting change |
Medium | < 4.48.2 | 4.48.2 |
| GHSA-7v28-g2pq-ggg8 Ghost vulnerable to remote code execution in locale setting change |
Medium | >= 5.0.0, < 5.2.3 | 5.2.3 |
| GHSA-fvc6-qjp7-m4g4 Arbitrary file upload in Ghost |
Critical EPSS 4.04% |
<= 4.39.0 | No fix yet |
| GHSA-ffhq-g856-9f2p Arbitrary file upload in Ghost |
Critical EPSS 3.50% |
<= 4.42.0 | No fix yet |
| GHSA-65p7-pjj8-ggmr Member account takeover |
Medium | >= 3.18.0, < 3.42.6 | 3.42.6 |
| GHSA-65p7-pjj8-ggmr Member account takeover |
Medium | >= 4.0.0, < 4.15.1 | 4.15.1 |
| GHSA-wfrj-qqc2-83cm Remote command injection when using sendmail email transport |
Medium | < 4.15.0 | 4.15.0 |
| GHSA-j5c2-hm46-wp5c Privilege escalation: all users can access Admin-level API keys |
Medium EPSS 1.02% |
>= 4.0.0, < 4.10.0 | 4.10.0 |
| GHSA-q4h8-7qff-gh6c Server-side request forgery in Ghost CMS |
High EPSS 1.22% |
< 3.10.0 | 3.10.0 |
| GHSA-9fgx-q25h-jxrg DOM XSS in Theme Preview |
Medium EPSS 7.94% |
>= 4.0.0, < 4.3.3 | 4.3.3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor