| Package | Affected versions | Patched versions |
|---|---|---|
| ghost | ≥ 3.24.0, < 6.19.1 | 6.19.1 |
| ghost | ≥ 3.24.0, < 6.19.1 | 6.19.1 |
A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database.
This vulnerability is present in Ghost v3.24.0 to v6.19.0.
v6.19.1 contains a fix for this issue.
Note: as this vulnerability lets an attacker gain access to a site's API keys, we recommend reviewing staff users and rotating keys. We generally recommend always updating Ghost to its most current version.
There is no application-level workaround. The Content API key is public by design, so restricting key access does not mitigate this vulnerability.
As a temporary mitigation, a reverse proxy or WAF rule can be used to block Content API requests containing slug%3A%5B or slug:[ in the query string filter parameter. Note that this may break legitimate slug filter functionality.
We thank Nicholas Carlini using Claude, Anthropic for disclosing this vulnerability responsibly.
If you have any questions or comments about this advisory, email us at [email protected].
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free