CVE-2026-29053: ghost Injection
Vulnerability summary
CVE-2026-29053 is a critical (CVSS 9.8) Injection vulnerability in ghost. EPSS estimates a 4.99% chance of exploitation in the next 30 days, higher than 92.1% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 05-03-2026PublishedVulnerability first disclosed.
- 05-03-2026Last modifiedVulnerability information updated.
Description
Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA7.7HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · NpmEcosystem advisory · calculated7.6HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HDiffers
EPSS trend
Probability
4.99%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
+1.41 pp
From 3.58% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundGhost_CMS 6.19.0 - Remote Code Execution
Maturity: poc
Ghost CMS Remote Code Execution
exploit/multi/http/ghostcms_auth_rce_cve_2026_29053
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Ghost1 product
- ghost≥ 0.7.2, < 6.19.1
Npm1 product
- ghost≥ 0.7.2, < 6.19.1
Tryghost1 product
- ghost≥ 0.7.2, < 6.19.1
3 vendors · 3 products
References
3 links- github.com/TryGhost/Ghost/security/advisories/GHSA-cgc2-rcrh-qr5xX Refsource CONFIRMWEBVendor Advisory
- github.com/TryGhost/GhostPACKAGE