Ghost versions >=0.5.3 and <6.50.0 contain an improper neutralization of input vulnerability during web page generation. Specifically, the JSON-LD HTML tag emitted by the {{ghost_head}} helper does not sanitize injected data properly. An authenticated user with limited privileges can inject malicious script code that executes in the context of published pages, potentially compromising staff admin sessions. The CVSS 4.0 score is 8.6 (high severity), reflecting network attack vector, low attack complexity, no privileges required for the attacker beyond limited authentication, and high impact on confidentiality, integrity, and availability.

An attacker with limited authenticated privileges can inject malicious script code into published pages via the JSON-LD tag. When a staff user views the affected page, the injected script can execute in their browser context, potentially compromising their admin session. This could lead to unauthorized administrative actions or further compromise of the Ghost platform.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to trusted users only and avoid viewing untrusted published content. Monitor the vendor's official channels for updates regarding patches or mitigations.