Vulnerability · Published Oct 1, 2026 · Assigned by VulnCheck
CVE-2026-103277Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
High 8.1
In plain English
A high-severity cross-site scripting in Ghost from TryGhost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.3%top 80.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially compromising administrative access.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- GitHub Security Advisory (GHSA-8vhf-xxpj-4qrg) vendor-advisory
- VulnCheck Advisory: Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed third-party-advisory