Threats tagged 'ghsa-788w-68h3-cvxp'

A code injection vulnerability exists in the image processing library used by Ghost for SVG handling. This flaw allows any staff user, including Contributors, to create a bookmark card for a malicious website, which can lead to arbitrary command execution on the Ghost server. The vulnerability affects Ghost versions from 6.56.0 up to but not including 6.67.0. A fix is available in version 6.67.0.