Back github.com

github.com /TryGhost/Ghost/security/advisories/GHSA-788w-68h3-cvxp

github.com • October 8, 2026

An image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server.

This vulnerability is present in Ghost from v6.56.0 up to v6.65.0.

v6.67.0 contains a fix for this issue.

For self-hosters using Docker, find Docker's official Ghost image here . Updating a Docker-based Ghost instance is documented here .

If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here .

We thank Rafael B. for disclosing this vulnerability responsibly.

If you have any questions or this advisory, email us at [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ghost Vulnerability CVE-2026-105642 Enables Remote Code Execution A vulnerability identified as CVE-2026-105642 affects the Ghost image processing library, specifically its handling of SVG files. This flaw allows any staff user, including Contributors, to create a bookmark card linked to an attacker-controlled website, which can execute arbitrary commands on the Ghost server. The vulnerability impacts Ghost versions from v6.56.0 to v6.65.0, with a fix included in v6.67.0 released on October 5, 2026. Users are urged to update their installations to mitigate this risk. The vulnerability was disclosed responsibly by researcher Rafael B. The CVSS score for this vulnerability is 8.8, categorizing it as high severity. 1 sources 63

Extracted Entities

github.com /TryGhost/Ghost/security/advisories/GHSA-788w-68h3-cvxp

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Domains (1)

Email Addresses (1)

MITRE ATT&CK (1)

Tools (1)