Ghost Vulnerable to Remote Code Execution via Malicious Themes

緊急 9.8CVE-2026-29053 · BIT-ghost-2026-29053 · GHSA-cgc2-rcrh-qr5x · 05/03/2026 公開 · 17/06/2026 更新

要点

CVE-2026-29053 は ghost (ghost), ghost に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：4.9%（全脆弱性の 92.1% より高い）。
対処：6.19.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
ghost ghost	`≥ 0.7.2, < 6.19.1`	`6.19.1`
ghost npm	`≥ 0.7.2, < 6.19.1`	`6.19.1`

概要

Impact

Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.

Vulnerable Versions

This vulnerability is present in Ghost v0.7.2 to v6.19.0.

Patches

v6.19.1 contains a fix for this issue.

Workarounds

Ghost generally recommends users refrain from installing untrusted themes. If a malicious theme has already been installed, it is recommended to uninstall the theme and then inspect it to understand its impact, which will be attack-specific.

References

Ghost thanks Cristian-Alexandru Staicu at Endor Labs for disclosing this vulnerability responsibly.

For more information

If there are any questions or comments about this advisory, email Ghost at [email protected].

NVD の説明

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.