| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| ghost | ≥ 0.7.2, < 6.19.1 | 6.19.1 |
| ghost | ≥ 0.7.2, < 6.19.1 | 6.19.1 |
Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.
This vulnerability is present in Ghost v0.7.2 to v6.19.0.
v6.19.1 contains a fix for this issue.
Ghost generally recommends users refrain from installing untrusted themes. If a malicious theme has already been installed, it is recommended to uninstall the theme and then inspect it to understand its impact, which will be attack-specific.
Ghost thanks Cristian-Alexandru Staicu at Endor Labs for disclosing this vulnerability responsibly.
If there are any questions or comments about this advisory, email Ghost at [email protected].
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí