Vulnerability · Published Oct 5, 2026 · Assigned by GitHub_M

CVE-2026-105642Ghost: Remote Code Execution via Bookmark Card Images

High 8.8

In plain English

A high-severity code injection in Ghost from TryGhost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 81.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. This issue is fixed in version 6.67.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	ghost	6.67.0	GHSA-788w-68h3-cvxp

Affected products (as reported)

Vendor	Product	Versions
TryGhost	Ghost	>= 6.56.0, < 6.67.0

Weakness: CWE-94, CWE-1395 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-788w-68h3-cvxp x_refsource_CONFIRM