CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images

Advisories.Gitlab • October 8, 2026

An image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server.

github.com /TryGhost/Ghost/security/advisories/GHSA-788w-68h3-cvxp

github.com /advisories/GHSA-788w-68h3-cvxp

nvd.nist.gov /vuln/detail/CVE-2026-105642

Code Behaviors & Features

This section shows behaviors and features detected in ghost@6.61.0 (analyzed on Aug 29, 2026). Filter by language, category, or risk level to focus on specific areas. You can also browse a copy of the raw source code .

OS Command Execution high Executes operating system commands or external programs, creating potential command injection risks. functionality Locations: bin/ create-migration.js :6 bin/ create-migration.js :6 core/s…ripts/ docker-analytics-manager.js :20 core/s…ripts/ docker-analytics-manager.js :20

Executes operating system commands or external programs, creating potential command injection risks.

bin/ create-migration.js :6

core/s…ripts/ docker-analytics-manager.js :20

MD5 high Implements MD5 hash function, which is cryptographically broken and unsuitable for security contexts. cryptography Locations: core/frontend/meta/ asset-url.js :27 core/frontend/services/rss/ cache.js :10 core/fronten…eb/routers/ serve-favicon.js :14 core/front…/routers/ serve-public-file.js :96 core/server/lib/image/ gravatar.js :21 core/server/ser…/remote-flags/ resolve.js :25 core/server/web/admin/ controller.js :35

Implements MD5 hash function, which is cryptographically broken and unsuitable for security contexts.

core/frontend/meta/ asset-url.js :27

core/frontend/services/rss/ cache.js :10

core/fronten…eb/routers/ serve-favicon.js :14

core/front…/routers/ serve-public-file.js :96

core/server/lib/image/ gravatar.js :21

core/server/ser…/remote-flags/ resolve.js :25

core/server/web/admin/ controller.js :35

File Reading medium Reads files from the filesystem, requiring proper path validation to prevent path traversal vulnerabilities. functionality Locations: bin/ create-migration.js :88 bin/ create-migration.js :122 bin/ generate-golden-email.js :100 content/themes/casper/ gulpfile.js :119 content/themes/source/ gulpfile.js :108 core/frontend/se…ces/asset-hash/ index.js :37 core/frontend…inification/ card-assets.js :49 core/server…ta/seeders/ data-generator.js :148 core…ls/ member-welcome-email-renderer.js :26 core…ls/ member-welcome-email-renderer.js :30 core…ls/ member-welcome-email-renderer.js :34 core…ls/ member-welcome-email-renderer.js :41 core…ls/ member-welcome-email-renderer.js :46 core…ls/ member-welcome-email-renderer.js :51 core/server/web/admin/ controller.js :34 core/server/web/gift-preview/ image.js :37

Reads files from the filesystem, requiring proper path validation to prevent path traversal vulnerabilities.

bin/ create-migration.js :88

bin/ create-migration.js :122

bin/ generate-golden-email.js :100

content/themes/casper/ gulpfile.js :119

content/themes/source/ gulpfile.js :108

core/frontend/se…ces/asset-hash/ index.js :37

core/frontend…inification/ card-assets.js :49

core/server…ta/seeders/ data-generator.js :148

core…ls/ member-welcome-email-renderer.js :26

core…ls/ member-welcome-email-renderer.js :30

core…ls/ member-welcome-email-renderer.js :34

core…ls/ member-welcome-email-renderer.js :41

core…ls/ member-welcome-email-renderer.js :46

core…ls/ member-welcome-email-renderer.js :51

core/server/web/admin/ controller.js :34

core/server/web/gift-preview/ image.js :37

File Writing medium Writes files to the filesystem, requiring proper path validation to prevent path traversal vulnerabilities. functionality Locations: bin/ create-migration.js :105 bin/ create-migration.js :118 bin/ create-migration.js :124 bin/ generate-golden-email.js :122 core/front…fication/ admin-auth-assets.js :23

Writes files to the filesystem, requiring proper path validation to prevent path traversal vulnerabilities.

bin/ create-migration.js :105

bin/ create-migration.js :118

bin/ create-migration.js :124

bin/ generate-golden-email.js :122

core/front…fication/ admin-auth-assets.js :23

Environment Variables medium Reads environment variables, which may expose sensitive configuration information. functionality Locations: bin/ generate-golden-email.js :9 bin/ generate-golden-email.js :37 content/themes/casper/ gulpfile.js :129 content/themes/source/ gulpfile.js :118 core/ boot.js :463 core/ boot.js :687 core/cli/ command.js :46 core/cli/ generate-data.js :61 core/frontend…ices/helpers/ handlebars.js :29 core/server/api/…ializers/input/ pages.js :178 core/server/api/…ializers/input/ pages.js :191 core/server/api/…ializers/input/ posts.js :222 core/server/api/…ializers/input/ posts.js :235 core/server/data/db/ connection.js :70 core/server/data/db/ connection.js :71 core/server/data/db/ connection.js :71 core/server…ta/seeders/ data-generator.js :244 core/server…ta/seeders/ data-generator.js :355 core/server…/importers/ table-importer.js :83 core/s…ripts/ docker-analytics-manager.js :23 core/s…ripts/ docker-analytics-manager.js :160 core/s…ripts/ docker-analytics-manager.js :161 core/s…ripts/ docker-analytics-manager.js :166 core/s…ripts/ docker-analytics-manager.js :167 core/ser…cripts/ docker-database-utils.js :16 core/ser…cripts/ docker-database-utils.js :17 core/ser…cripts/ docker-database-utils.js :18 core/ser…cripts/ docker-database-utils.js :19 core/ser…cripts/ docker-database-utils.js :20 core/server/lib/ get-inbox-links.js :129 core/server/lib/ lexical.js :158 core/server/lib/ lexical.js :164 core/server/lib/ request-external.js :312 core/server/models/base/plugins/ crud.js :129 core/server/mod…s/base/plugins/ events.js :11 core/server/mod…s/base/plugins/ events.js :11 core/server…h/session/ session-service.js :368 core/se…ments/ -service-emails.js :276 core/server/serv…analytics/jobs/ index.js :17 core/server/serv…analytics/jobs/ index.js :27 core/server/serv…analytics/jobs/ index.js :37 core/ser…ervice/ batch-sending-service.js :102 core/ser…ervice/ batch-sending-service.js :102 core/ser…ervice/ batch-sending-service.js :109 core/ser…ervice/ batch-sending-service.js :109 core/ser…ervice/ batch-sending-service.js :117 core/ser…ervice/ batch-sending-service.js :117 core/server…il-service/ email-renderer.js :354 core/server/services/gifts/jobs/ index.js :12 core/server/ser…elcome-emails/ service.js :333 core/server/services/members/ api.js :76 core/server/serv…s/members/jobs/ index.js :12 core/serv…ervices/ geolocation-service.js :18 core/server/ser…es/milestones/ service.js :14 core/server/ser…es/milestones/ service.js :84 core/serv…letters/ newsletters-service.js :391 core/server…ces/oembed/ oembed-service.js :401 core/server/ser…/public-config/ config.js :53 cor…e/ incoming-recommendation-service.js :26 cor…e/ incoming-recommendation-service.js :26 core/se…ervice/ recommendation-service.js :41 core/serve…s-helpers/ settings-helpers.js :277 core/se…ttings/ settings-bread-service.js :488 core/serv…cations/ slack-notifications.js :179 core/ser…s/staff/ staff-service-emails.js :606 core/server/services/stripe/ config.js :65 core/server/s…vices/stripe/ stripe-api.js :18 core…ion/ verification-webhook-service.js :49 core/server…/webhooks/ webhook-trigger.js :148 core/server/w…points/admin/ middleware.js :50 core/shared/config/ loader.js :72 core/shared/config/ secrets.js :33 core/shared/config/ utils.js :118 index.js :10 index.js :10

Reads environment variables, which may expose sensitive configuration information.

bin/ generate-golden-email.js :9

bin/ generate-golden-email.js :37

content/themes/casper/ gulpfile.js :129

content/themes/source/ gulpfile.js :118

core/cli/ command.js :46

core/cli/ generate-data.js :61

core/frontend…ices/helpers/ handlebars.js :29

core/server/api/…ializers/input/ pages.js :178

core/server/api/…ializers/input/ pages.js :191

core/server/api/…ializers/input/ posts.js :222

core/server/api/…ializers/input/ posts.js :235

core/server/data/db/ connection.js :70

core/server/data/db/ connection.js :71

core/server…ta/seeders/ data-generator.js :244

core/server…ta/seeders/ data-generator.js :355

core/server…/importers/ table-importer.js :83

core/s…ripts/ docker-analytics-manager.js :23

core/s…ripts/ docker-analytics-manager.js :160

core/s…ripts/ docker-analytics-manager.js :161

core/s…ripts/ docker-analytics-manager.js :166

core/s…ripts/ docker-analytics-manager.js :167

core/ser…cripts/ docker-database-utils.js :16

core/ser…cripts/ docker-database-utils.js :17

core/ser…cripts/ docker-database-utils.js :18

core/ser…cripts/ docker-database-utils.js :19

core/ser…cripts/ docker-database-utils.js :20

core/server/lib/ get-inbox-links.js :129

core/server/lib/ lexical.js :158

core/server/lib/ lexical.js :164

core/server/lib/ request-external.js :312

core/server/models/base/plugins/ crud.js :129

core/server/mod…s/base/plugins/ events.js :11

core/server…h/session/ session-service.js :368

core/se…ments/ -service-emails.js :276

core/server/serv…analytics/jobs/ index.js :17

core/server/serv…analytics/jobs/ index.js :27

core/server/serv…analytics/jobs/ index.js :37

core/ser…ervice/ batch-sending-service.js :102

core/ser…ervice/ batch-sending-service.js :109

core/ser…ervice/ batch-sending-service.js :117

core/server…il-service/ email-renderer.js :354

core/server/services/gifts/jobs/ index.js :12

core/server/ser…elcome-emails/ service.js :333

core/server/services/members/ api.js :76

core/server/serv…s/members/jobs/ index.js :12

core/serv…ervices/ geolocation-service.js :18

core/server/ser…es/milestones/ service.js :14

core/server/ser…es/milestones/ service.js :84

core/serv…letters/ newsletters-service.js :391

core/server…ces/oembed/ oembed-service.js :401

core/server/ser…/public-config/ config.js :53

cor…e/ incoming-recommendation-service.js :26

core/se…ervice/ recommendation-service.js :41

core/serve…s-helpers/ settings-helpers.js :277

core/se…ttings/ settings-bread-service.js :488

core/serv…cations/ slack-notifications.js :179

core/ser…s/staff/ staff-service-emails.js :606

core/server/services/stripe/ config.js :65

core/server/s…vices/stripe/ stripe-api.js :18

core…ion/ verification-webhook-service.js :49

core/server…/webhooks/ webhook-trigger.js :148

core/server/w…points/admin/ middleware.js :50

core/shared/config/ loader.js :72

core/shared/config/ secrets.js :33

core/shared/config/ utils.js :118

Environment Variables Writing medium Modifies environment variables, which may affect application security if overwriting sensitive settings. functionality Locations: core/cli/ generate-data.js :61 index.js :10

Modifies environment variables, which may affect application security if overwriting sensitive settings.

core/cli/ generate-data.js :61

Password Handling medium Processes passwords, requiring secure storage and comparison techniques to protect sensitive credentials. authentication Locations: core/frontend…blogging/lib/ middleware.js :122

Processes passwords, requiring secure storage and comparison techniques to protect sensitive credentials.

core/frontend…blogging/lib/ middleware.js :122

YAML medium Processes YAML data, which may be vulnerable to deserialization attacks if parsing untrusted input. serialization Locations: core/se…irects/ redirect-config-parser.js :40 core/ser…ttings/ route-settings-parser.js :8 core/server/s…te-settings/ yaml-parser.js :1

Processes YAML data, which may be vulnerable to deserialization attacks if parsing untrusted input.

core/se…irects/ redirect-config-parser.js :40

core/ser…ttings/ route-settings-parser.js :8

core/server/s…te-settings/ yaml-parser.js :1

File Uploading medium Processes file uploads, requiring careful validation to prevent security issues like path traversal. functionality Locations: core/server/web/api/middleware/ upload.js :3

Processes file uploads, requiring careful validation to prevent security issues like path traversal.

core/server/web/api/middleware/ upload.js :3

GZip Extraction medium Extracts GZip archive files, which may expose path traversal vulnerabilities if not properly validated. archive Locations: core/server/web/api/middleware/ upload.js :305

Extracts GZip archive files, which may expose path traversal vulnerabilities if not properly validated.

core/server/web/api/middleware/ upload.js :305

JWT low Implements JSON Web Tokens for authentication, requiring proper validation and secure algorithms. authentication Locations: bin/ generate-golden-email.js :7 core/server/adapters/scheduling/ utils.js :7 core/server/api/endpoints/ featurebase.js :1 core/server/serv…s/auth/api-key/ admin.js :1 core/server/serv…s/auth/members/ index.js :1 core/se…tokens/ identity-token-service.js :4 core/server/…i/services/ token-service.js :2 core/serve…/tinybird/ tinybird-service.js :1

Implements JSON Web Tokens for authentication, requiring proper validation and secure algorithms.

bin/ generate-golden-email.js :7

core/server/adapters/scheduling/ utils.js :7

core/server/api/endpoints/ featurebase.js :1

core/server/serv…s/auth/api-key/ admin.js :1

core/server/serv…s/auth/members/ index.js :1

core/se…tokens/ identity-token-service.js :4

core/server/…i/services/ token-service.js :2

core/serve…/tinybird/ tinybird-service.js :1

RNG low Implements cryptographic random number generation for security-sensitive operations. cryptography Locations: core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :1812 core/…ets/ framework-provider-DqI25epG.js :1 core/bu…assets/ limit-service-BhiEvqcP.js :1 cor…s/ offers-container-modal-DWycIMzT.js :1 core/fronten…middleware/ admin-toolbar.js :28 core/serve…ib/redis/ AdapterCacheRedis.js :131 core/serve…ib/redis/ AdapterCacheRedis.js :374 2026-01-08-11-48-16-add-indexnow-api-key-setting.js :6 2025-10-02-15-13-31-add-members-otc-secret-setting.js :6 2026-08-10-08-20-50-add-machine-payments-settings.js :25 core/server…/importers/ table-importer.js :35 core/server/models/ settings.js :74 core/server/models/ settings.js :75 core/server/models/ settings.js :76 core/server/models/ settings.js :79 core/server/models/ settings.js :80 core/server/models/ settings.js :81 core/server/models/ settings.js :85 core/server/models/ single-use-token.js :13 core/server…h/session/ session-service.js :78 core/server/ser…ces/gift-links/ models.js :13 core/server/…vices/gifts/ gift-service.js :292 core/se…ection/ link-redirects-service.js :60 co…s/ request-integrity-token-provider.js :23 core/server…es/members/ stripe-connect.js :30 core/s…tings/ private-site-access-code.js :60 core/s…tings/ private-site-access-code.js :61

Implements cryptographic random number generation for security-sensitive operations.

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :1812

core/…ets/ framework-provider-DqI25epG.js :1

core/bu…assets/ limit-service-BhiEvqcP.js :1

cor…s/ offers-container-modal-DWycIMzT.js :1

core/fronten…middleware/ admin-toolbar.js :28

core/serve…ib/redis/ AdapterCacheRedis.js :131

core/serve…ib/redis/ AdapterCacheRedis.js :374

2026-01-08-11-48-16-add-indexnow-api-key-setting.js :6

2025-10-02-15-13-31-add-members-otc-secret-setting.js :6

2026-08-10-08-20-50-add-machine-payments-settings.js :25

core/server…/importers/ table-importer.js :35

core/server/models/ settings.js :74

core/server/models/ settings.js :75

core/server/models/ settings.js :76

core/server/models/ settings.js :79

core/server/models/ settings.js :80

core/server/models/ settings.js :81

core/server/models/ settings.js :85

core/server/models/ single-use-token.js :13

core/server…h/session/ session-service.js :78

core/server/ser…ces/gift-links/ models.js :13

core/server/…vices/gifts/ gift-service.js :292

core/se…ection/ link-redirects-service.js :60

co…s/ request-integrity-token-provider.js :23

core/server…es/members/ stripe-connect.js :30

core/s…tings/ private-site-access-code.js :60

core/s…tings/ private-site-access-code.js :61

HTTP Client low Implements HTTP client functionality to make network requests. networking Locations: core/built/…min/assets/ index-DjQe-e5s.js :2 core/server/lib/ request-external.js :6 core/server…h/session/ session-service.js :6 core/serv…ervices/ geolocation-service.js :1

Implements HTTP client functionality to make network requests.

core/built/…min/assets/ index-DjQe-e5s.js :2

core/server/lib/ request-external.js :6

core/server…h/session/ session-service.js :6

core/serv…ervices/ geolocation-service.js :1

SHA-256 low Implements SHA-256 hash function, providing strong cryptographic integrity protection. cryptography Locations: core/frontend/se…ces/asset-hash/ index.js :38 core/frontend…inification/ card-assets.js :130 core…ns/ get-scheduler-idempotency-key.js :9 core/s…ction/ link-redirect-repository.js :231 core/server/…ts/adapters/ x402-adapter.js :364 core/server/…ts/adapters/ x402-adapter.js :369 core/s…bers/ single-use-token-provider.js :139 core/shared/private-site-access/ index.js :22

Implements SHA-256 hash function, providing strong cryptographic integrity protection.

core/frontend/se…ces/asset-hash/ index.js :38

core/frontend…inification/ card-assets.js :130

core…ns/ get-scheduler-idempotency-key.js :9

core/s…ction/ link-redirect-repository.js :231

core/server/…ts/adapters/ x402-adapter.js :364

core/server/…ts/adapters/ x402-adapter.js :369

core/s…bers/ single-use-token-provider.js :139

core/shared/private-site-access/ index.js :22

Implements HMAC (Hash-based Message Authentication Code) for message authentication.

core/fronten…middleware/ admin-toolbar.js :17

core/server/lib/ signed-webhook.js :19

core/server…il-service/ email-renderer.js :939

core/server/s…ices/members/ middleware.js :66

core/server/s…ices/members/ middleware.js :146

co…s/ request-integrity-token-provider.js :24

co…s/ request-integrity-token-provider.js :44

core/s…bers/ single-use-token-provider.js :253

core/serve…s-helpers/ settings-helpers.js :193

core/server…/webhooks/ webhook-trigger.js :137

Lodash low Processes Lodash templates, which may introduce template injection if user input is not escaped. templating Locations: core/frontend/…ne/handlebars/ template.js :3 core/frontend/…ne/handlebars/ template.js :3 core/frontend/…ne/handlebars/ template.js :3 core/frontend/…ne/handlebars/ template.js :3

Processes Lodash templates, which may introduce template injection if user input is not escaped.

core/frontend/…ne/handlebars/ template.js :3

Cookie Sessions low Manages user sessions using HTTP cookies, which may expose session data to client-side access. functionality Locations: core/server…/endpoints/ authentication.js :19 core/server…/endpoints/ authentication.js :23 core/se…points/ members-stripe-connect.js :23 core/server…h/session/ express-session.js :2 core/server…h/session/ express-session.js :34 core/server…h/session/ express-session.js :35 core/server…h/session/ express-session.js :43 core/server…h/session/ session-service.js :220 core/server…h/session/ session-service.js :229 core/server…h/session/ session-service.js :295 core/server…h/session/ session-service.js :304 core/server/…th/session/ session-store.js :1 core/server/…th/session/ session-store.js :1 core/shared/private-site-access/ index.js :2 core/shared/private-site-access/ index.js :29 core/shared/private-site-access/ index.js :30 core/shared/private-site-access/ index.js :51 core/shared/private-site-access/ index.js :52

Manages user sessions using HTTP cookies, which may expose session data to client-side access.

core/server…/endpoints/ authentication.js :19

core/server…/endpoints/ authentication.js :23

core/se…points/ members-stripe-connect.js :23

core/server…h/session/ express-session.js :2

core/server…h/session/ express-session.js :34

core/server…h/session/ express-session.js :35

core/server…h/session/ express-session.js :43

core/server…h/session/ session-service.js :220

core/server…h/session/ session-service.js :229

core/server…h/session/ session-service.js :295

core/server…h/session/ session-service.js :304

core/server/…th/session/ session-store.js :1

core/shared/private-site-access/ index.js :2

core/shared/private-site-access/ index.js :29

core/shared/private-site-access/ index.js :30

core/shared/private-site-access/ index.js :51

core/shared/private-site-access/ index.js :52

Handlebars low Processes Handlebars templates, which may introduce template injection if user input is not escaped. templating Locations: cor…s/ -service-email-renderer.js :8 core/server…il-service/ email-renderer.js :1082 core/serv…s/gifts/ gift-email-renderer.js :9 core…ls/ member-welcome-email-renderer.js :24 core/ser…s/staff/ staff-service-emails.js :27

Processes Handlebars templates, which may introduce template injection if user input is not escaped.

cor…s/ -service-email-renderer.js :8

core/server…il-service/ email-renderer.js :1082

core/serv…s/gifts/ gift-email-renderer.js :9

core…ls/ member-welcome-email-renderer.js :24

core/ser…s/staff/ staff-service-emails.js :27

JSON informational Processes JSON data, which requires careful handling when parsing untrusted input. serialization Locations: bin/ create-migration.js :88 bin/ create-migration.js :118 bin/ create-migration.js :122 bin/ create-migration.js :124 bin/ generate-golden-email.js :81 bin/ generate-golden-email.js :100 bin/ generate-golden-email.js :107 content/themes/casper/ gulpfile.js :119 content/themes/source/ gulpfile.js :108 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :126 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :2219 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :4034 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :4414 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :5678 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6252 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6530 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6540 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6595 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6601 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6633 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6642 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6662 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6663 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6710 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7086 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7088 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7302 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7653 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7662 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7662 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7778 core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7793 core/built/a…ctivitypub/ dist-ByFmDSNP.js :415 core/built/a…ctivitypub/ dist-ByFmDSNP.js :482 core/built/a…ctivitypub/ dist-ByFmDSNP.js :482 core/bui…itypub/ edit-profile-DsZM3rTX.js :1529 core/bui…itypub/ edit-profile-DsZM3rTX.js :1739 core/bui…itypub/ edit-profile-DsZM3rTX.js :2312 core/bui…itypub/ edit-profile-DsZM3rTX.js :2655 core/bui…itypub/ edit-profile-DsZM3rTX.js :3387 core/bui…itypub/ edit-profile-DsZM3rTX.js :3387 core/bui…itypub/ edit-profile-DsZM3rTX.js :3393 core/bui…itypub/ edit-profile-DsZM3rTX.js :3393 core/bui…itypub/ edit-profile-DsZM3rTX.js :3418 core/bui…itypub/ edit-profile-DsZM3rTX.js :3418 core/bui…itypub/ edit-profile-DsZM3rTX.js :3566 core/bui…itypub/ edit-profile-DsZM3rTX.js :3566 core/bui…itypub/ edit-profile-DsZM3rTX.js :3571 core/bui…itypub/ edit-profile-DsZM3rTX.js :3571 core/bui…itypub/ edit-profile-DsZM3rTX.js :3628 core/bui…itypub/ edit-profile-DsZM3rTX.js :3631 core/buil…vitypub/ onboarding-mat5Hrl0.js :9 core/buil…vitypub/ onboarding-mat5Hrl0.js :16 core/bui…vitypub/ preferences-BCqUdC3v.js :9400 core/bui…vitypub/ preferences-BCqUdC3v.js :9418 core/bui…vitypub/ preferences-BCqUdC3v.js :9436 core/built/…tivitypub/ routes-BSXT992i.js :39 core/built/…tivitypub/ routes-BSXT992i.js :48 co…/ use-activity-pub-queries-BoVOxXkV.js :138 core/built/…ctivitypub/ users-CoX6FT_K.js :1341 cor…s/ announcement-bar-modal-DM3cYOpo.js :1 cor…s/ announcement-bar-modal-DM3cYOpo.js :1 core/bui…/assets/ automations-sAcJ1334.js :1 core/bui…/assets/ automations-sAcJ1334.js :1 core/built/…min/assets/ chart-BrhA41Zi.js :6 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :1 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :1 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :2 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :2 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :2 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :2 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :2 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :2 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :2 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :2 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :2 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :2 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :4 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :4 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :4 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :4 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :4 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :4 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :4 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :4 core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :4 cor…ts/ chunk.896.435fe0637944d4a69810.js :23 cor…ts/ chunk.896.435fe0637944d4a69810.js :24 cor…ts/ chunk.896.435fe0637944d4a69810.js :25 cor…ts/ chunk.896.435fe0637944d4a69810.js :39 cor…ts/ chunk.896.435fe0637944d4a69810.js :54 cor…ts/ chunk.896.435fe0637944d4a69810.js :54 cor…ts/ chunk.896.435fe0637944d4a69810.js :63 cor…ts/ chunk.896.435fe0637944d4a69810.js :64 cor…ts/ chunk.896.435fe0637944d4a69810.js :65 cor…ts/ chunk.896.435fe0637944d4a69810.js :77 cor…ts/ chunk.896.435fe0637944d4a69810.js :330 core/bui…assets/ color-picker-BTY_NdEm.js :1 core/bui…/assets/ color-utils-Dzeeuj1F.js :1 co…/ custom-field-type-option-CsGIZk1J.js :9 co…/ custom-field-type-option-CsGIZk1J.js :9 co…/ custom-field-type-option-CsGIZk1J.js :9 co…/ custom-field-type-option-CsGIZk1J.js :9 co…/ custom-field-type-option-CsGIZk1J.js :9 cor…s/ design-and-theme-modal-DUSKM4uC.js :3 cor…s/ design-and-theme-modal-DUSKM4uC.js :3 cor…s/ design-and-theme-modal-DUSKM4uC.js :3 cor…s/ design-and-theme-modal-DUSKM4uC.js :22 cor…s/ design-and-theme-modal-DUSKM4uC.js :22 cor…s/ design-and-theme-modal-DUSKM4uC.js :22 cor…s/ design-and-theme-modal-DUSKM4uC.js :22 cor…s/ design-and-theme-modal-DUSKM4uC.js :22 core/built/admin/assets/ dist-DIC8yz5C.js :1 core/built/admin/assets/ dist-DIC8yz5C.js :1 core/built/admin/assets/ dist-DIC8yz5C.js :1 core/built/admin/assets/ dist-Z97pCNqS.js :7 core/built/admin/assets/ dist-Z97pCNqS.js :11 core/built/admin/assets/ dist-Z97pCNqS.js :11 core/built/admin/assets/ dist-Z97pCNqS.js :11 core/built/admin/assets/ dist-Z97pCNqS.js :11 core/built/admin/assets/ dist-Z97pCNqS.js :11 core/built/…in/assets/ editor-BP883Lpn.js :8 core/built/…in/assets/ editor-BP883Lpn.js :8 core/built/…in/assets/ editor-BP883Lpn.js :8 core/built/admin/assets/ esm-CXo5SEPy.js :2 core/…ets/ framework-provider-DqI25epG.js :1 core/…ets/ framework-provider-DqI25epG.js :1 core/bu…assets/ history-modal-iKwUY3XR.js :1 core/built/…min/assets/ hooks-CuEZV2-q.js :2 core/built/…min/assets/ index-DjQe-e5s.js :2 core/built/…min/assets/ index-DjQe-e5s.js :2 core/built/…min/assets/ index-DjQe-e5s.js :2 core/built/…min/assets/ index-DjQe-e5s.js :2 core/built/…min/assets/ index-DjQe-e5s.js :2 core/built/…min/assets/ index-DjQe-e5s.js :4 core/built…n/assets/ index.es-VihPwfeH.js :1 core/bui…/assets/ jsx-runtime-DX3WBWVO.js :8 core/built/…min/assets/ luxon-D1RVjjpq.js :1 core/built/…min/assets/ luxon-D1RVjjpq.js :1 core/built/…min/assets/ luxon-D1RVjjpq.js :1 core/built/…min/assets/ luxon-D1RVjjpq.js :1 core/built/…min/assets/ luxon-D1RVjjpq.js :1 core/bu…assets/ member-detail-B6uec2a6.js :1 core/built…in/assets/ members-BQF3CqhI.js :2 core/built…in/assets/ members-BQF3CqhI.js :2 core/built…in/assets/ members-BQF3CqhI.js :2 core/built…in/assets/ members-BQF3CqhI.js :2 core/built…in/assets/ members-BQF3CqhI.js :2 core/b…sets/ -modal-DX-gNF3X.js :1 core/b…sets/ -modal-DX-gNF3X.js :1 core/b…sets/ -modal-DX-gNF3X.js :1 core/b…sets/ -modal-DX-gNF3X.js :1 core/built…n/assets/ nql-lang-CaWrLesS.js :1 core/built…n/assets/ nql-lang-CaWrLesS.js :1 core/built…n/assets/ nql-lang-CaWrLesS.js :7 core/buil…/assets/ onboarding-B4YhlZ0i.js :1 core/buil…/assets/ onboarding-B4YhlZ0i.js :1 core/bui…assets/ portal-modal-BvvdF_B9.js :1 core/bui…assets/ portal-modal-BvvdF_B9.js :1 core/bui…assets/ portal-modal-BvvdF_B9.js :1 core/bui…assets/ portal-modal-BvvdF_B9.js :1 core/bui…assets/ portal-modal-BvvdF_B9.js :1 core/bu…ssets/ post-analytics-DX470WRG.js :1 core/bui…/assets/ preferences-DO0UUWFp.js :5 core/bui…/assets/ preferences-DO0UUWFp.js :5 core/bui…/assets/ preferences-DO0UUWFp.js :5 core/built…in/assets/ schemas-4UPic-oD.js :1 core/built…in/assets/ schemas-4UPic-oD.js :1 core/built…in/assets/ schemas-4UPic-oD.js :3 core/built…in/assets/ schemas-4UPic-oD.js :62 core/built…in/assets/ schemas-4UPic-oD.js :64 core/built…in/assets/ schemas-4UPic-oD.js :64 core/built…in/assets/ schemas-4UPic-oD.js :64 core/built…in/assets/ schemas-4UPic-oD.js :64 core/built…in/assets/ schemas-4UPic-oD.js :64 core/built…in/assets/ schemas-4UPic-oD.js :64 core/built…in/assets/ schemas-4UPic-oD.js :64 core/built…in/assets/ schemas-4UPic-oD.js :64 core/built…in/assets/ schemas-4UPic-oD.js :64 core/built…in/assets/ schemas-4UPic-oD.js :64 core/built…in/assets/ schemas-4UPic-oD.js :64 core/built…in/assets/ schemas-4UPic-oD.js :64 core/built…n/assets/ settings-b8kNzZSQ.js :2 core/built…n/assets/ settings-b8kNzZSQ.js :2 core/built…n/assets/ settings-b8kNzZSQ.js :2 core/built…n/assets/ settings-b8kNzZSQ.js :2 core/built…n/assets/ settings-b8kNzZSQ.js :2 core/built…n/assets/ settings-b8kNzZSQ.js :2 core/built…n/assets/ settings-b8kNzZSQ.js :2 core/built…n/assets/ settings-b8kNzZSQ.js :2 core/built…n/assets/ settings-b8kNzZSQ.js :3 core/built…n/assets/ settings-b8kNzZSQ.js :4 core…ts/ stripe-connect-modal-Z-UT_BGc.js :1 core/…ets/ testimonials-modal-sFwRnNLh.js :1 core/…sets/ tier-detail-modal-BCFpWwUS.js :1 core/…sets/ tier-detail-modal-BCFpWwUS.js :1 core/…sets/ use-filter-params-CAvfDvf1.js :1 core/bu…assets/ use-url-input-Df5QzNa7.js :5 core/bu…assets/ use-url-input-Df5QzNa7.js :5 core/bu…assets/ use-url-input-Df5QzNa7.js :5 core/bu…assets/ use-url-input-Df5QzNa7.js :5 core/bu…assets/ use-url-input-Df5QzNa7.js :5 core/bu…assets/ use-url-input-Df5QzNa7.js :5 core/bu…assets/ use-url-input-Df5QzNa7.js :5 core/bu…assets/ use-url-input-Df5QzNa7.js :5 core/bu…assets/ use-url-input-Df5QzNa7.js :5 core/buil…n/assets/ validator-Cr0sMKuW.js :4 core/frontend/helpers/ get.js :79 core/frontend/helpers/ ghost_head.js :449 core/frontend/helpers/ json.js :12 core/frontend/public/ private.js :13 core/frontend/public/ private.js :54 core/frontend/public/ private.js :282 core/front…fication/ admin-auth-assets.js :53 core/frontend…inification/ card-assets.js :49 core/frontend…inification/ card-assets.js :53 core/frontend/services/rss/ cache.js :10 core/frontend/se…eme-engine/i18n/ i18n.js :203 core/frontend/s…/theme-engine/ preview.js :44 core/fronte…dmin-auth/ message-handler.js :22 core/fronte…dmin-auth/ message-handler.js :35 core/fronte…dmin-auth/ message-handler.js :71 core/fronte…dmin-auth/ message-handler.js :79 core/frontend…ghost-stats/ ghost-stats.js :117 core/fron…ribution/ member-attribution.js :47 core/fron…ribution/ member-attribution.js :173 core/frontend/src/utils/ privacy.js :39 core/frontend/src/utils/ privacy.js :48 core/frontend/src/utils/ privacy.js :49 core/frontend/src/utils/ privacy.js :54 core/serv…rs/jobs/ InMemoryJobsBackend.js :22 core/server/ad…rs/redirects/ FileStore.js :50 core/serve…redirects/ S3RedirectsStore.js :174 core/server/api/…ializers/input/ pages.js :183 core/server/api/…ializers/input/ posts.js :227 core/server/ap…alizers/input/ settings.js :138 core/server/ap…alizers/input/ settings.js :147 core/serve…ors/input/ automated_emails.js :59 core/serve…ors/input/ automated_emails.js :100 core/server/ap…idators/input/ settings.js :35 core/server/ap…idators/input/ settings.js :154 core/server/ap…idators/input/ settings.js :186 core/server/data/db/ backup.js :21 core/server/data/db/ backup.js :39 core/server/data…porter/handlers/ json.js :30 core/server/data…/importers/data/ base.js :80 core/server/data…/importers/data/ base.js :127 core/server/data…/importers/data/ base.js :136 core/server/data…/importers/data/ base.js :146 core/server/data…/importers/data/ base.js :154 core/server/data…/importers/data/ base.js :160 core/server/data…/importers/data/ base.js :302 cor…ta/ custom-theme-settings-importer.js :32 core/server…rters/data/ posts-importer.js :275 core/server…rters/data/ posts-importer.js :306 core/server…rters/data/ posts-importer.js :310 core/server…rters/data/ posts-importer.js :326 core/serve…ers/data/ products-importer.js :105 core/serve…ers/data/ products-importer.js :129 core/serve…ers/data/ settings-importer.js :11 core/serve…ers/data/ settings-importer.js :104 core/serve…ers/data/ settings-importer.js :132 core/serve…ers/data/ settings-importer.js :216 core/serve…ers/data/ settings-importer.js :222 core/serve…ers/data/ settings-importer.js :233 core/server…/importers/ importer-revue.js :15 2022-05-21-00-00-regenerate-posts-html.js :36 2024-12-02-17-48-40-add-index-redirects-from.js :16 2022-08-23-13-59-fix-page-resource-type.js :11 2024-01-30-19-36-44-fix-discrepancy-in-free-tier-visibility.js :21 core/server…ta/seeders/ data-generator.js :148 automation-action-revisions-importer.js :83 core/serve…importers/ members-importer.js :91 core/server…/importers/ posts-importer.js :78 core/ser…orters/ web-mentions-importer.js :35 core/s…ripts/ docker-analytics-manager.js :530 core/s…ripts/ docker-analytics-manager.js :776 core/server/lib/ bootstrap-socket.js :44 core/server/lib/package-json/ parse.js :34 core/server/lib/ signed-webhook.js :39 core/server/models/base/ listeners.js :89 core/server/models/base/ listeners.js :114 core/ser…/models/ custom-theme-setting.js :19 core/ser…/models/ custom-theme-setting.js :42 core/server/models/ post.js :722 core/server/models/ session.js :8 core/server/models/ session.js :17 core/server/models/ settings.js :124 core/server/models/ settings.js :144 core/server/models/ settings.js :211 core/server/models/ settings.js :248 core/server/models/ settings.js :301 core/server/models/ settings.js :422 core/server/models/ settings.js :433 core/server/models/ user.js :15 core/server/models/ user.js :504 core/server/models/ user.js :504 core/server/models/ user.js :668 core/server/models/ user.js :668 core/server…r-manager/ adapter-manager.js :157 core/server/serv…dapter-manager/ utils.js :77 core/server…tomations/ automations-api.js :164 core/server…tomations/ automations-api.js :173 core/server…tomations/ automations-api.js :181 core/server/se…mport/import/ post-data.js :86 core/se…irects/ redirect-config-parser.js :53 gift-email-analytics-batch-processor.js :31 core/server/ser…analytics/lib/ queries.js :35 core/server/ser…analytics/lib/ queries.js :183 core/server/…il-service/ email-service.js :325 core/se…ervice/ mailgun-email-provider.js :166 core/ser…re-ping/ explore-ping-service.js :79 core/server/…es/exports/ site-exporter.js :98 core/server/…obs-service/ jobs-service.js :31 core/server/…obs-service/ jobs-service.js :51 core/server/…obs-service/ jobs-service.js :64 core/server…rvices/lib/ mailgun-client.js :70 core/server/s…ts/adapters/ mpp-adapter.js :187 core/server/…ts/adapters/ x402-adapter.js :377 core/server/…ts/adapters/ x402-adapter.js :384 core/server/ser…hine-payments/ service.js :229 core/server/ser…hine-payments/ service.js :258 core/ser…stripe/ deposit-address-store.js :116 core/ser…stripe/ deposit-address-store.js :138 core/se…nting/ member-commenting-codec.js :12 core/se…nting/ member-commenting-codec.js :33 core/server/serv…-export/import/ spool.js :19 core/server/serv…-export/import/ spool.js :22 core/serve…trollers/ router-controller.js :286 core/serve…trollers/ router-controller.js :348 core/serve…trollers/ router-controller.js :815 core/serve…trollers/ router-controller.js :816 core/serve…trollers/ router-controller.js :913 core/serve…trollers/ router-controller.js :988 core/serve…trollers/ router-controller.js :1216 core/server/s…members-api/ members-api.js :321 core/server/s…members-api/ members-api.js :421 core/serve…sitories/ member-repository.js :2503 core/serve…sitories/ member-repository.js :2575 core/serv…sitories/ product-repository.js :463 core/serv…sitories/ product-repository.js :473 core/s…bers/ single-use-token-provider.js :50 core/s…bers/ single-use-token-provider.js :88 core/server…es/members/ stripe-connect.js :32 core/server…es/members/ stripe-connect.js :62 core…ons/ bookshelf-mention-repository.js :41 core…ons/ bookshelf-mention-repository.js :139 core/serv…mentions/ mention-controller.js :129 core/server/services/mentions/ mention.js :93 core/server/services/mentions/ mention.js :96 core/server/services/mentions/ mention.js :313 core/server/services/mentions/ mention.js :313 core/se…embed/ twitter-oembed-provider.js :145 cor…e/ recommendation-metadata-service.js :33 core/serv…/service/ well-known-service.js :30 core/ser…e-flags/ remote-flags-service.js :108 core/ser…e-flags/ remote-flags-service.js :145 core/se…ttings/ settings-bread-service.js :33 core/se…ttings/ settings-bread-service.js :183 core/se…ttings/ settings-bread-service.js :379 core/serv…cations/ slack-notifications.js :173 core/serv…ack-ping/ slack-ping-service.js :168 core/ser…s/staff/ staff-service-emails.js :511 core/server/se…s/stats/utils/ tinybird.js :112 core/server/se…s/stats/utils/ tinybird.js :122 cor…ok/ checkout-session-event-service.js :361 core/server/s…vices/stripe/ stripe-api.js :289 core/server/s…vices/stripe/ stripe-api.js :298 core/server/s…vices/stripe/ stripe-api.js :301 core/server/s…vices/stripe/ stripe-api.js :405 core/server/s…vices/stripe/ stripe-api.js :409 core/server/s…vices/stripe/ stripe-api.js :412 core/server/s…vices/stripe/ stripe-api.js :904 core/server/s…vices/stripe/ stripe-api.js :918 core/server/s…vices/stripe/ stripe-api.js :922 core/server/s…vices/stripe/ stripe-api.js :925 core/serve…s/stripe/ stripe-migrations.js :165 core/serve…s/stripe/ stripe-migrations.js :201 core/serve…s/stripe/ stripe-migrations.js :204 core/serve…s/stripe/ stripe-migrations.js :246 core/serve…s/stripe/ stripe-migrations.js :290 core/serve…s/stripe/ stripe-migrations.js :294 core/serve…s/stripe/ stripe-migrations.js :323 core/serve…s/stripe/ stripe-migrations.js :413 core/serve…s/stripe/ stripe-migrations.js :555 core/serve…s/stripe/ stripe-migrations.js :596 core/serve…s/stripe/ stripe-migrations.js :600 core/ser…e-check/ update-check-service.js :160 core/serve…vices/url/ lazy-url-service.js :324 core/server…/webhooks/ webhook-trigger.js :124 core/server/w…gift-preview/ controller.js :104 core/server/web/gift-preview/ image.js :194 core/server/…middleware/ queue-request.js :17 core/shared/config/ utils.js :125 core…he/ custom-theme-settings-service.js :62 core…he/ custom-theme-settings-service.js :75 core/shared/…ings-cache/ cache-manager.js :172

Processes JSON data, which requires careful handling when parsing untrusted input.

bin/ create-migration.js :88

bin/ create-migration.js :118

bin/ create-migration.js :122

bin/ create-migration.js :124

bin/ generate-golden-email.js :81

bin/ generate-golden-email.js :100

bin/ generate-golden-email.js :107

content/themes/casper/ gulpfile.js :119

content/themes/source/ gulpfile.js :108

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :126

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :2219

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :4034

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :4414

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :5678

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6252

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6530

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6540

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6595

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6601

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6633

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6642

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6662

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6663

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :6710

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7086

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7088

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7302

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7653

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7662

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7778

core/bu…typub/ chunk-KS7C4IRE-Ck3O4oo2.js :7793

core/built/a…ctivitypub/ dist-ByFmDSNP.js :415

core/built/a…ctivitypub/ dist-ByFmDSNP.js :482

core/bui…itypub/ edit-profile-DsZM3rTX.js :1529

core/bui…itypub/ edit-profile-DsZM3rTX.js :1739

core/bui…itypub/ edit-profile-DsZM3rTX.js :2312

core/bui…itypub/ edit-profile-DsZM3rTX.js :2655

core/bui…itypub/ edit-profile-DsZM3rTX.js :3387

core/bui…itypub/ edit-profile-DsZM3rTX.js :3393

core/bui…itypub/ edit-profile-DsZM3rTX.js :3418

core/bui…itypub/ edit-profile-DsZM3rTX.js :3566

core/bui…itypub/ edit-profile-DsZM3rTX.js :3571

core/bui…itypub/ edit-profile-DsZM3rTX.js :3628

core/bui…itypub/ edit-profile-DsZM3rTX.js :3631

core/buil…vitypub/ onboarding-mat5Hrl0.js :9

core/buil…vitypub/ onboarding-mat5Hrl0.js :16

core/bui…vitypub/ preferences-BCqUdC3v.js :9400

core/bui…vitypub/ preferences-BCqUdC3v.js :9418

core/bui…vitypub/ preferences-BCqUdC3v.js :9436

core/built/…tivitypub/ routes-BSXT992i.js :39

core/built/…tivitypub/ routes-BSXT992i.js :48

co…/ use-activity-pub-queries-BoVOxXkV.js :138

core/built/…ctivitypub/ users-CoX6FT_K.js :1341

cor…s/ announcement-bar-modal-DM3cYOpo.js :1

core/bui…/assets/ automations-sAcJ1334.js :1

core/built/…min/assets/ chart-BrhA41Zi.js :6

core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :1

core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :2

core/bu…ssets/ chunk-KS7C4IRE-DCsL4i4D.js :4

cor…ts/ chunk.896.435fe0637944d4a69810.js :23

cor…ts/ chunk.896.435fe0637944d4a69810.js :24

cor…ts/ chunk.896.435fe0637944d4a69810.js :25

cor…ts/ chunk.896.435fe0637944d4a69810.js :39

cor…ts/ chunk.896.435fe0637944d4a69810.js :54

cor…ts/ chunk.896.435fe0637944d4a69810.js :63

cor…ts/ chunk.896.435fe0637944d4a69810.js :64

cor…ts/ chunk.896.435fe0637944d4a69810.js :65

cor…ts/ chunk.896.435fe0637944d4a69810.js :77

cor…ts/ chunk.896.435fe0637944d4a69810.js :330

core/bui…assets/ color-picker-BTY_NdEm.js :1

core/bui…/assets/ color-utils-Dzeeuj1F.js :1

co…/ custom-field-type-option-CsGIZk1J.js :9

cor…s/ design-and-theme-modal-DUSKM4uC.js :3

cor…s/ design-and-theme-modal-DUSKM4uC.js :22

core/built/admin/assets/ dist-DIC8yz5C.js :1

core/built/admin/assets/ dist-Z97pCNqS.js :7

core/built/admin/assets/ dist-Z97pCNqS.js :11

core/built/…in/assets/ editor-BP883Lpn.js :8

core/built/admin/assets/ esm-CXo5SEPy.js :2

core/…ets/ framework-provider-DqI25epG.js :1

core/bu…assets/ history-modal-iKwUY3XR.js :1

core/built/…min/assets/ hooks-CuEZV2-q.js :2

core/built/…min/assets/ index-DjQe-e5s.js :2

core/built/…min/assets/ index-DjQe-e5s.js :4

core/built…n/assets/ index.es-VihPwfeH.js :1

core/bui…/assets/ jsx-runtime-DX3WBWVO.js :8

core/built/…min/assets/ luxon-D1RVjjpq.js :1

core/bu…assets/ member-detail-B6uec2a6.js :1

core/built…in/assets/ members-BQF3CqhI.js :2

core/b…sets/ -modal-DX-gNF3X.js :1

core/built…n/assets/ nql-lang-CaWrLesS.js :1

core/built…n/assets/ nql-lang-CaWrLesS.js :7

core/buil…/assets/ onboarding-B4YhlZ0i.js :1

core/bui…assets/ portal-modal-BvvdF_B9.js :1

core/bu…ssets/ post-analytics-DX470WRG.js :1

core/bui…/assets/ preferences-DO0UUWFp.js :5

core/built…in/assets/ schemas-4UPic-oD.js :1

core/built…in/assets/ schemas-4UPic-oD.js :3

core/built…in/assets/ schemas-4UPic-oD.js :62

core/built…in/assets/ schemas-4UPic-oD.js :64

core/built…n/assets/ settings-b8kNzZSQ.js :2

core/built…n/assets/ settings-b8kNzZSQ.js :3

core/built…n/assets/ settings-b8kNzZSQ.js :4

core…ts/ stripe-connect-modal-Z-UT_BGc.js :1

core/…ets/ testimonials-modal-sFwRnNLh.js :1

core/…sets/ tier-detail-modal-BCFpWwUS.js :1

core/…sets/ use-filter-params-CAvfDvf1.js :1

core/bu…assets/ use-url-input-Df5QzNa7.js :5

core/buil…n/assets/ validator-Cr0sMKuW.js :4

core/frontend/helpers/ get.js :79

core/frontend/helpers/ ghost_head.js :449

core/frontend/helpers/ json.js :12

core/frontend/public/ private.js :13

core/frontend/public/ private.js :54

core/frontend/public/ private.js :282

core/front…fication/ admin-auth-assets.js :53

core/frontend…inification/ card-assets.js :49

core/frontend…inification/ card-assets.js :53

core/frontend/services/rss/ cache.js :10

core/frontend/se…eme-engine/i18n/ i18n.js :203

core/frontend/s…/theme-engine/ preview.js :44

core/fronte…dmin-auth/ message-handler.js :22

core/fronte…dmin-auth/ message-handler.js :35

core/fronte…dmin-auth/ message-handler.js :71

core/fronte…dmin-auth/ message-handler.js :79

core/frontend…ghost-stats/ ghost-stat...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ghost Vulnerability CVE-2026-105642 Enables Remote Code Execution A vulnerability identified as CVE-2026-105642 affects the Ghost image processing library, specifically its handling of SVG files. This flaw allows any staff user, including Contributors, to create a bookmark card linked to an attacker-controlled website, which can execute arbitrary commands on the Ghost server. The vulnerability impacts Ghost versions from v6.56.0 to v6.65.0, with a fix included in v6.67.0 released on October 5, 2026. Users are urged to update their installations to mitigate this risk. The vulnerability was disclosed responsibly by researcher Rafael B. The CVSS score for this vulnerability is 8.8, categorizing it as high severity. 1 sources 63

Extracted Entities

CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)

Ransomware Groups (1)