Ghost (Node.js) – Support, CVEs & Health

Security

Known Vulnerabilities

10 active CVEs reported via OSV.dev

GHSA-2gx6-7gx2-wwcf CVSS_V3

Ghost: Cross-Site Scripting in Universal Import

Published: 2026-08-04 Fixed in: 6.54.1

GHSA-4wx2-7gvj-qfq3 CVSS_V3

Ghost: Archived Offers can be Redeemed

Published: 2026-08-04 Fixed in: 6.54.1

GHSA-5fp7-g646-ccf4 CVSS_V3

Ghost has Staff 2FA bypass

Published: 2026-01-08 Fixed in: 6.11.0

GHSA-62q6-4hv4-vjrw CVSS_V3

Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

Published: 2026-07-01 Fixed in: 6.37.0

GHSA-65p7-pjj8-ggmr CVSS_V3

Member account takeover

Published: 2021-09-23 Fixed in: 3.42.6

GHSA-78x2-cwp9-5j42 CVSS_V3

Ghost's improper authentication allows access to member information and actions

Published: 2024-08-20 Fixed in: 5.89.5

GHSA-7mpp-r37j-x5wh CVSS_V3

Ghost: Session Fixation in Ghost Admin

Published: 2026-08-04 Fixed in: 6.54.1

GHSA-7v28-g2pq-ggg8 CVSS_V3

Ghost vulnerable to remote code execution in locale setting change

Published: 2022-06-17 Fixed in: 4.48.2

GHSA-944x-pm95-3jpr CVSS_V3

Ghost: File Upload Content-Type Spoofing

Published: 2026-08-04 Fixed in: 6.21.1

GHSA-99vc-xw8j-phjm CVSS_V3

Ghost has possible Cross-site Scripting issue

Published: 2024-02-11 No fix available