GHSA-gv6q-2m97-882h
High · 8.8CVSS
8.8
EPSS
—
Published
Jan 28, 2026
CISA due date
—
The record
Ghost vulnerable to XSS via malicious Portal preview links
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @tryghost/portal | 2.29.1 | 2.51.5 |
| npm | @tryghost/portal | 2.52.0 | 2.57.1 |
| npm | ghost | 5.43.0 | 5.121.0 |
| npm | ghost | 6.0.0 | 6.15.0 |
| Bitnami | ghost | 5.43.0 | 5.121.0 |
Related vulnerabilities
- CVE-2026-24778 Ghost is an open source content management system. Same vulnerability
- CVE-2026-29784 Ghost is a Node.js content management system. Also affects ghost
- CVE-2026-29053 Ghost is a Node.js content management system. Also affects ghost
- GHSA-9m84-wc28-w895 Ghost has incomplete CSRF protections around OTC use Also affects ghost
- GHSA-cgc2-rcrh-qr5x Ghost Vulnerable to Remote Code Execution via Malicious Themes Also affects ghost
- CVE-2026-26980 Ghost is a Node.js content management system. Also affects ghost
- GHSA-w52v-v783-gw97 Ghost has a SQL injection in Content API Also affects ghost
- CVE-2026-22597 Ghost is a Node.js content management system. Also affects ghost