Threats tagged 'ghsa-69qc-f5m6-889c'

CVE-2026-105643 is a cross-site scripting (XSS) vulnerability in the Ghost blogging platform affecting versions from 6.34.0 up to but not including 6.67.0. The flaw allows any staff user, including Contributors, to embed scripts in post content that execute when another staff user opens the post in the editor, potentially compromising the admin session of that user. The issue arises from improper neutralization of input during web page generation related to embed cards in the Ghost editor. The vulnerability has been fixed in version 6.67.0.