CVE-2026-105644: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in TryGhost Ghost

TryGhost Ghost, a Node.js content management system, had an XSS vulnerability (CWE-79) due to improper sanitization of SVG images included in content imports. Versions from 4.0.0 to before 6.67.0 stored these SVG images without neutralizing potentially malicious scripts. An attacker could exploit this by tricking an Administrator into importing a crafted SVG file, enabling script execution in the context of the site and risking compromise of staff admin sessions. The vulnerability is addressed in version 6.67.0.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the Ghost CMS site domain, which can lead to compromise of administrative user sessions. This could result in unauthorized actions performed with admin privileges. There is no indication of impact on availability. The CVSS score of 6.8 reflects a medium severity with high confidentiality and integrity impact but requires user interaction and has high attack complexity.

Upgrade to Ghost version 6.67.0 or later, where the vulnerability is fixed. No other mitigations are specified or recommended by the vendor. Patch status is confirmed fixed in 6.67.0.