CVE-2026-105645: CWE-1333: Inefficient Regular Expression Complexity in TryGhost Ghost

Ghost, a Node.js content management system, contains a vulnerability identified as CVE-2026-105645 (CWE-1333) affecting versions >=5.37.0 and <6.67.0. The flaw is due to inefficient regular expression complexity in the external media inliner, which can be triggered by a crafted request requiring Administrator access. Exploitation leads to excessive CPU consumption, causing the Ghost server to become unresponsive. The vulnerability has a CVSS 3.1 base score of 4.9, reflecting a medium severity denial-of-service impact. The vendor fixed the issue in version 6.67.0.

Successful exploitation results in a denial-of-service condition by causing excessive CPU usage, rendering the Ghost server unresponsive. There is no impact on confidentiality or integrity. Exploitation requires Administrator privileges, limiting the attack surface.

Upgrade Ghost to version 6.67.0 or later where this vulnerability is fixed. Since the issue requires Administrator access, restricting administrative privileges and monitoring for unusual CPU usage may help reduce risk until patching is applied.