CVE-2026-104413: Ghost Stored XSS via Bookmark Card Images
Summary
CVE-2026-104413: Ghost: Stored XSS via Bookmark Card Images. Affects ghost versions >= 5.94.0, < 6.64.0. Fixed in 6.64.0. How to fix ↓
Also tracked for
The same CVE-2026-104413 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source publishing platform designed for creating and managing online content. It provides a user-friendly interface for bloggers and publishers, allowing them to easily create, edit, and publish posts. Ghost supports various features such as themes, plugins, and integrations, making it a versatile choice for content creators. However, like any software, it is susceptible to vulnerabilities that can compromise its security and the safety of its users.
Vulnerability Detail
The vulnerability identified as CVE-2026-104413 in Ghost allows for stored cross-site scripting (XSS) attacks through bookmark card images. When a user creates a bookmark card, Ghost can inadvertently store non-image files fetched from external websites as bookmark icons or thumbnails. This flaw enables any staff user, including Contributors, to host arbitrary HTML on the site's domain. Consequently, this could lead to the compromise of other staff users' admin sessions, posing a significant security risk.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.64.0
This is the first release that contains the fix.
npm install ghost@6.64.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that users with staff access are educated about the risks of uploading non-image files as bookmark icons. Regularly audit the bookmark cards to remove any suspicious entries until the update can be applied.
Conclusion
The CVE-2026-104413 vulnerability in Ghost poses a significant risk due to the potential for stored XSS attacks. It is crucial for users to update to version 6.64.0 or later to mitigate this risk. In the meantime, implementing workarounds and educating staff can help reduce the likelihood of exploitation.
See every vulnerability recorded for ghost →
FAQ
CVE-2026-104413 is a vulnerability in Ghost that allows for stored XSS attacks via bookmark card images.
Any staff user of Ghost, including Contributors, can be affected as they can host arbitrary HTML on the site's domain.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 7.3, indicating a high severity level.
If you cannot update immediately, educate your staff about the risks and regularly audit bookmark cards for suspicious content.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
