CVE-2026-105643: Ghost Stored XSS via Embed Card Previews
Summary
CVE-2026-105643: Ghost: Stored XSS via Embed Card Previews. Affects ghost versions >= 6.34.0, < 6.67.0. Fixed in 6.67.0. How to fix ↓
Also tracked for
- ghost · Bitnami
The same CVE-2026-105643 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source publishing platform designed for creating and managing online content. It offers a user-friendly interface for writers and publishers, enabling them to create posts, manage subscriptions, and engage with their audience. However, like many web applications, Ghost is susceptible to security vulnerabilities that can compromise user data and session integrity.
Vulnerability Detail
The vulnerability identified as CVE-2026-105643 allows for stored Cross-Site Scripting (XSS) attacks via embed card previews in the Ghost editor. This issue arises from the ability of any staff user, including Contributors, to store malicious scripts in post content. When another staff user opens the post in the editor, these scripts can execute, potentially compromising the user's admin session. This vulnerability affects Ghost versions from 6.34.0 to 6.65.0 and poses a significant risk to the security of user accounts and data integrity.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.67.0
This is the first release that contains the fix.
npm install ghost@6.67.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For self-hosted sites, it is recommended to leave the new security.embedPreviewUrl configuration option at its default setting to mitigate the risk until an update can be applied.
Conclusion
CVE-2026-105643 represents a significant security risk for users of the Ghost platform, allowing for stored XSS attacks that can compromise admin sessions. It is crucial for users to update their installations to version 6.67.0 or later to mitigate this vulnerability. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for ghost →
FAQ
CVE-2026-105643 is a vulnerability in the Ghost publishing platform that allows for stored XSS attacks through embed card previews.
Ghost versions from 6.34.0 to 6.65.0 are vulnerable to this issue.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2026-105643 is 7.3, indicating a high severity level.
To update your Ghost installation, follow the appropriate documentation for your setup, either using Docker or Ghost-CLI, to upgrade to version 6.67.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
