CVE-2026-104414: Ghost Stored XSS Vulnerability via oEmbed Photo Responses
Summary
CVE-2026-104414: Ghost: Stored XSS via oEmbed Photo Responses. Affects ghost versions >= 2.5.0, < 6.64.0. Fixed in 6.64.0. How to fix ↓
Also tracked for
The same CVE-2026-104414 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source publishing platform designed for creating and managing online content. It provides a user-friendly interface for bloggers and publishers, enabling them to easily create, edit, and publish posts. The platform supports various integrations, including oEmbed, which allows users to embed content from other websites. However, this functionality can be exploited if not properly secured, leading to vulnerabilities such as stored cross-site scripting (XSS).
Vulnerability Detail
The vulnerability arises from the ability to embed URLs from attacker-controlled websites, which can lead to untrusted scripts being stored in post content. These scripts may execute in the Ghost editor, on the published site, and in newsletter emails, potentially compromising the admin sessions of staff users. This issue affects versions of Ghost from v2.1.0 up to v6.64.0, making it critical for users to address it promptly.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.64.0
This is the first release that contains the fix.
npm install ghost@6.64.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
The stored XSS vulnerability in Ghost poses significant risks to users, particularly those managing sensitive content. It is crucial to update to version 6.64.0 or later to mitigate these risks. Regular monitoring and updates are essential to maintain the security of your Ghost installation.
See every vulnerability recorded for ghost →
FAQ
The vulnerability is a stored cross-site scripting (XSS) issue that allows untrusted scripts to be stored and executed in the Ghost platform.
The vulnerability affects Ghost versions from 2.1.0 up to 6.64.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
The vulnerability was disclosed responsibly by SecBuddyF of Tencent KeenLab and Nhat Anh Vu.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
