CVE-2026-105642: Ghost Remote Code Execution via Bookmark Card Images
Summary
CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images. Affects ghost versions >= 6.56.0, < 6.67.0. Fixed in 6.67.0. How to fix ↓
Also tracked for
- ghost · Bitnami
The same CVE-2026-105642 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source publishing platform designed for creating and managing online content. It is built on Node.js and offers a user-friendly interface for bloggers and publishers. Ghost supports various features such as customizable themes, membership options, and integrations with third-party services. However, it has a vulnerability in its image processing library, specifically in handling SVG files, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from the way Ghost processes SVG images within bookmark cards. Any staff user, including contributors, can create a bookmark card linking to an attacker-controlled website. This action can trigger the execution of arbitrary commands on the Ghost server, potentially leading to complete system compromise. The vulnerability is present in Ghost versions from 6.56.0 to 6.65.0 and is classified with a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.67.0
This is the first release that contains the fix.
npm install ghost@6.67.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the bookmark card creation feature to trusted users only. This can help mitigate the risk until the vulnerability is patched.
Conclusion
The vulnerability CVE-2026-105642 in Ghost poses a significant risk due to its potential for remote code execution. Users are strongly advised to update to version 6.67.0 or later to mitigate this risk. Additionally, implementing access restrictions can provide temporary protection until the update is applied.
See every vulnerability recorded for ghost →
FAQ
CVE-2026-105642 is a vulnerability in the Ghost publishing platform that allows remote code execution via malicious SVG images in bookmark cards.
Ghost versions from 6.56.0 to 6.65.0 are vulnerable to this issue.
You can check your Ghost version by running ghost version in your terminal. If it falls within the vulnerable range, you should update immediately.
If you cannot update right away, restrict access to the bookmark card feature to trusted users as a temporary workaround.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file, allowing you to stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
