CVE-2026-24778: Ghost Package Vulnerable to XSS via Malicious Portal Preview Links
Summary
CVE-2026-24778: Ghost vulnerable to XSS via malicious Portal preview links. Affects ghost across 2 version ranges.
>= 5.43.0, < 5.121.0
>= 6.0.0, < 6.15.0
Fixed in 5.121.0 or 6.15.0, depending on the release line you run. How to fix ↓
Also tracked for
- ghost · Bitnami
The same CVE-2026-24778 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is an open-source publishing platform designed for creating and managing online content. It offers a user-friendly interface and powerful features for bloggers and businesses alike. However, certain versions of Ghost and its Portal component have been found to be vulnerable to cross-site scripting (XSS) attacks, which can compromise user accounts and data integrity.
Vulnerability Detail
The vulnerability allows an attacker to craft a malicious link that, when accessed by an authenticated staff user or member, executes JavaScript with the victim's permissions. This could lead to account takeover and unauthorized access to sensitive information. The vulnerability exists in specific versions of Ghost and its Portal component, making it critical for users to address it promptly.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.43.0, < 5.121.05.121.0npm install ghost@5.121.0 -
>= 6.0.0, < 6.15.06.15.0npm install ghost@6.15.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If users are running a customized or self-hosted version of the Portal, they must manually rebuild from or update to the latest patch version to mitigate the vulnerability.
Conclusion
The vulnerability CVE-2026-24778 poses a significant risk to users of the Ghost package, allowing for potential account takeover through XSS attacks. It is crucial for users to upgrade to the patched versions to protect their applications and data.
See every vulnerability recorded for ghost →
FAQ
CVE-2026-24778 is a vulnerability in the Ghost package that allows for cross-site scripting (XSS) attacks via malicious Portal preview links.
Ghost versions v5.43.0 to v5.120.4 and v6.0.0 to v6.14.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If immediate upgrading is not possible, consider implementing a workaround by manually updating the Portal component to the latest patch version.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
