| Package | Affected versions | Patched versions |
|---|---|---|
| ghost | ≥ 0.7.2, < 6.19.1 | 6.19.1 |
| ghost | ≥ 0.7.2, < 6.19.1 | 6.19.1 |
Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.
This vulnerability is present in Ghost v0.7.2 to v6.19.0.
v6.19.1 contains a fix for this issue.
Ghost generally recommends users refrain from installing untrusted themes. If a malicious theme has already been installed, it is recommended to uninstall the theme and then inspect it to understand its impact, which will be attack-specific.
Ghost thanks Cristian-Alexandru Staicu at Endor Labs for disclosing this vulnerability responsibly.
If there are any questions or comments about this advisory, email Ghost at [email protected].
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free