CVE-2026-105643: tryghost ghost Cross-site Scripting

Vulnerability summary

CVE-2026-105643 is a high (CVSS 7.3) Cross-site Scripting vulnerability in tryghost ghost. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-10-2026
   PublishedVulnerability first disclosed.
2. 06-10-2026
   Last modifiedVulnerability information updated.

Description

Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, potentially compromising that user’s admin session. Self-hosted sites should leave the new  security.embedPreviewUrl  configuration option at its default value. This issue is fixed in version 6.67.0.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
• CWE-653Improper Isolation or CompartmentalizationThe product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.