Node.js Content Management System Vulnerability in Ghost by TryGhost

CVE-2026-105650

What is CVE-2026-105650?

Ghost, a popular Node.js-based content management system, has a vulnerability that allows scripts from attacker-controlled URLs to be embedded within post content. This can lead to unvalidated scripts running not just in the Ghost editor but also on the published site and in newsletter emails, posing a risk to the security of staff users' admin sessions. The issue has been addressed in version 6.64.0, ensuring that such vulnerabilities do not compromise the integrity of websites powered by Ghost.

References