Vulnerability · Published Oct 5, 2026 · Assigned by GitHub_M
CVE-2026-105643Ghost: Stored XSS via Embed Card Previews
High 7.3
In plain English
A high-severity cross-site scripting in Ghost from TryGhost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, potentially compromising that user’s admin session. Self-hosted sites should leave the new security.embedPreviewUrl configuration option at its default value. This issue is fixed in version 6.67.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | ghost | 6.67.0 | GHSA-69qc-f5m6-889c |
Affected products (as reported)
Weakness: CWE-79, CWE-653 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N