CVE-2026-105643: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in TryGhost Ghost

Ghost, a Node.js content management system, had a stored cross-site scripting vulnerability (CWE-79) in its embed cards feature between versions 6.34.0 and 6.67.0. The vulnerability allowed any staff user, including those with Contributor roles, to embed malicious scripts in post content. These scripts would execute when another staff user opened the post in the editor, risking compromise of the admin session. The vulnerability was fixed in version 6.67.0. Self-hosted sites are advised to keep the security.embedPreviewUrl configuration at its default to avoid exposure.

Successful exploitation allows a staff user with limited privileges to inject scripts that execute in the context of other staff users' admin sessions, potentially leading to session compromise and unauthorized actions within the Ghost admin interface. This elevates the risk of administrative account compromise and unauthorized content manipulation.

Upgrade Ghost to version 6.67.0 or later, where this vulnerability is fixed. For self-hosted instances, ensure the security.embedPreviewUrl configuration option remains at its default value as recommended by the vendor. No other specific mitigations are indicated.