CVE-2026-29053
High · 7.6CVSS
7.6
EPSS
5.1%
Published
Mar 5, 2026
CISA due date
—
The record
Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | ghost | 0.7.2 | 6.19.1 |
Related vulnerabilities
- GHSA-cgc2-rcrh-qr5x Ghost Vulnerable to Remote Code Execution via Malicious Themes Same vulnerability
- CVE-2026-29784 Ghost is a Node.js content management system. Also affects ghost
- GHSA-9m84-wc28-w895 Ghost has incomplete CSRF protections around OTC use Also affects ghost
- CVE-2026-26980 Ghost is a Node.js content management system. Also affects ghost
- GHSA-w52v-v783-gw97 Ghost has a SQL injection in Content API Also affects ghost
- GHSA-gv6q-2m97-882h Ghost vulnerable to XSS via malicious Portal preview links Also affects ghost
- CVE-2026-24778 Ghost is an open source content management system. Also affects ghost
- CVE-2026-22597 Ghost is a Node.js content management system. Also affects ghost