The @badzz88/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code. The targeted channel IDs are obfuscated or fetched remotely, allowing attackers to change targets after installation.
A quadratic complexity vulnerability in postcss-selector-parser allows specially crafted flat selectors with many class or id indexes to cause excessive CPU usage during parsing. This can lead to CPU exhaustion in environments that parse untrusted selectors synchronously, such as CSS sanitizers or online playgrounds. The issue is fixed in versions 7.1.6 and 6.1.5.
A missing authorization vulnerability in TryGhost Ghost allows users with the Author role to delete posts and pages they did not author. This issue affects Ghost versions from 5.81.0 up to but not including 6.60.0. The vulnerability has been fixed in version 6.60.0. The CVSS score is 6.5, indicating a medium severity impact primarily affecting availability. No known exploits are reported in the wild.
A cross-site scripting (XSS) vulnerability exists in TryGhost Ghost versions 6.22.1 through 6.64.0. The issue arises because the default local storage adapter does not enforce content type restrictions on uploaded files, allowing scripts to be hosted on the site's domain. This can lead to compromise of other staff users' admin sessions. The vulnerability is fixed in version 6.64.0.
A privilege management vulnerability in TryGhost Ghost allows staff users with Editor or Super Editor roles to assign their own role to Author and Contributor users, despite lacking permission to do so. This issue affects Ghost versions from 0.5.0 up to but not including 6.64.0. The vulnerability has a medium severity with a CVSS score of 4.3. Version 6.64.0 contains a fix that addresses this issue.
CVE-2026-105677 is a path traversal vulnerability in TryGhost Ghost that allows an authenticated Administrator to execute arbitrary code on the server via a crafted theme. The issue affects Ghost versions from 6.10.3 up to but not including 6.64.0. The vulnerability is fixed in version 6.64.0. This flaw arises from improper limitation of pathname to a restricted directory when loading theme translation files.
CVE-2026-105676 is a path traversal vulnerability in TryGhost Ghost affecting versions from 1.20.0 up to but not including 6.64.0. It allows an authenticated Administrator to read JSON files outside the active theme's directory, potentially exposing sensitive server configuration secrets. The issue is fixed in version 6.64.0.
A vulnerability in TryGhost Ghost versions 4.39.0 up to 6.64.0 allowed staff users with permission to view staff invites to discover secret tokens of pending invites, including those for roles with higher privileges. This could enable privilege escalation by accepting such invites. The issue is fixed in version 6.64.0.
CVE-2026-105652 is a low-severity vulnerability in TryGhost Ghost versions from 0.7.2 up to but not including 6.64.0. It allows any staff-level user to observe the relative ordering of other staff users' hashed passwords. This information disclosure does not reveal the actual password hashes nor does it provide a practical method to recover passwords. The issue is fixed in version 6.64.0.
A cross-site scripting (XSS) vulnerability exists in TryGhost Ghost when creating bookmark cards. Non-image files fetched from external websites could be stored as bookmark icons or thumbnails, allowing any staff user, including Contributors, to host arbitrary HTML on the site's domain. This may lead to compromise of other staff users' admin sessions. The vulnerability affects Ghost versions from 5.94.0 up to but not including 6.64.0. Version 6.64.0 contains a fix for this issue.
CVE-2026-105650 is a cross-site scripting (XSS) vulnerability in the TryGhost Ghost blogging platform affecting versions from 2.5.0 up to but not including 6.64.0. The flaw allows attacker-controlled URLs to embed untrusted scripts in post content, which may execute in the Ghost editor, on published sites, and in newsletter emails. This could lead to compromise of a staff user's administrative session. The issue is fixed in version 6.64.0.
A cross-site scripting (XSS) vulnerability exists in TryGhost Ghost where SVG media thumbnails and SVG images uploaded with incorrect file extensions were stored without proper sanitization. This flaw allows any staff user, including Contributors, to host malicious scripts on the site's domain, potentially compromising other staff users' admin sessions. The vulnerability affects Ghost versions from 4.22.0 up to but not including 6.65.0. Version 6.65.0 contains a fix for this issue.
A validation issue in TryGhost Ghost versions 6.0.9 through 6.64.0 allowed unauthenticated users to abuse certain functionality, such as Webmentions, to make limited HTTP requests to hosts within the Ghost server's internal network on some network configurations. The attack does not return response data. The vulnerability is fixed in version 6.65.0.
A time-of-check to time-of-use (TOCTOU) race condition vulnerability in TryGhost Ghost versions 6.54.1 through 6.64.0 allows unauthenticated users to abuse certain functionality, such as Webmentions, to make limited HTTP requests to hosts within the Ghost server's internal network. The attack does not return response data. The issue is fixed in version 6.65.0.
CVE-2026-105646 is a vulnerability in TryGhost Ghost versions 4.0.0 up to 6.65.0 that allows an attacker with Administrator access to cause excessive CPU usage via crafted content import files, potentially making the server unresponsive. The issue is fixed in version 6.67.0. The vulnerability has a medium severity with a CVSS score of 4.9.
CVE-2026-105645 is a vulnerability in TryGhost Ghost affecting versions from 5.37.0 up to but not including 6.67.0. It involves inefficient regular expression complexity in the external media inliner component, which can be exploited by an attacker with Administrator access to cause excessive CPU usage and render the Ghost server unresponsive. A fix for this issue is available in version 6.67.0.
CVE-2026-105644 is a cross-site scripting (XSS) vulnerability in TryGhost Ghost that affects versions from 4.0.0 up to 6.66.x. The issue arises because SVG images included in content imports were stored without proper sanitization. An attacker who tricks an Administrator into importing a crafted SVG file could host malicious scripts on the site's domain, potentially compromising admin user sessions. The vulnerability is fixed in version 6.67.0.
CVE-2026-105643 is a cross-site scripting (XSS) vulnerability in the Ghost blogging platform affecting versions from 6.34.0 up to but not including 6.67.0. The flaw allows any staff user, including Contributors, to embed scripts in post content that execute when another staff user opens the post in the editor, potentially compromising the admin session of that user. The issue arises from improper neutralization of input during web page generation related to embed cards in the Ghost editor. The vulnerability has been fixed in version 6.67.0.
A code injection vulnerability exists in the image processing library used by Ghost for SVG handling. This flaw allows any staff user, including Contributors, to create a bookmark card for a malicious website, which can lead to arbitrary command execution on the Ghost server. The vulnerability affects Ghost versions from 6.56.0 up to but not including 6.67.0. A fix is available in version 6.67.0.
The npm package 'serpacksven1' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.