CVE-2026-105651: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in TryGhost Ghost

Ghost, a Node.js content management system, contains a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability in versions >=5.94.0 and <6.64.0. When creating bookmark cards, Ghost improperly allows non-image files fetched from external sites to be stored as bookmark icons or thumbnails. This enables any staff user, including those with Contributor privileges, to host arbitrary HTML content on the site domain. Such behavior can result in cross-site scripting attacks that may compromise other staff users' administrative sessions. The vulnerability is fixed in version 6.64.0.

The vulnerability allows authenticated staff users with Contributor privileges to inject arbitrary HTML content into the site, potentially leading to cross-site scripting attacks. This can result in the compromise of other staff users' admin sessions, leading to unauthorized access or actions within the administrative interface. The CVSS v3.1 score is 7.3 (High), reflecting network attack vector, low attack complexity, required privileges, user interaction, and high confidentiality and integrity impact without availability impact.

Upgrade Ghost to version 6.64.0 or later, where this vulnerability has been fixed. No other mitigation or temporary workaround is indicated in the available data.