Ghost (Node.js) – Support, CVEs & Health

Security

Known Vulnerabilities

10 active CVEs reported via OSV.dev

GHSA-2gx6-7gx2-wwcf CVSS_V3

Ghost: Cross-Site Scripting in Universal Import

Published: 2026-08-04 Fixed in: 6.54.1

GHSA-322m-ff4g-9vx9 CVSS_V3

Ghost: Server-Side Request Forgery in Bookmark Fetching

Published: 2026-10-07 Fixed in: 6.65.0

GHSA-347q-26qq-h2p6 CVSS_V3

Ghost: Stored XSS via Bookmark Card Images

Published: 2026-10-07 Fixed in: 6.64.0

GHSA-354h-gmhv-mr9c CVSS_V3

Ghost: Server-Side Request Forgery in Webhook Trigger

Published: 2026-10-07 Fixed in: 6.27.0

GHSA-4pvx-fwjj-8gpc CVSS_V3

Ghost: Editors Could Promote Staff Users to Their Own Role

Published: 2026-10-07 Fixed in: 6.64.0

GHSA-4wx2-7gvj-qfq3 CVSS_V3

Ghost: Archived Offers can be Redeemed

Published: 2026-08-04 Fixed in: 6.54.1

GHSA-53vv-xm9f-mm82 CVSS_V3

Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Published: 2026-10-07 Fixed in: 6.64.0

GHSA-5fp7-g646-ccf4 CVSS_V3

Ghost has Staff 2FA bypass

Published: 2026-01-08 Fixed in: 6.11.0

GHSA-62q6-4hv4-vjrw CVSS_V3

Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

Published: 2026-07-01 Fixed in: 6.37.0

GHSA-65p7-pjj8-ggmr CVSS_V3

Member account takeover

Published: 2021-09-23 Fixed in: 3.42.6