CVE-2026-29053: Ghost Package Vulnerable to Remote Code Execution via Malicious Themes
Summary
CVE-2026-29053: Ghost Vulnerable to Remote Code Execution via Malicious Themes. Affects ghost versions >= 0.7.2, < 6.19.1. Fixed in 6.19.1. How to fix ↓
Also tracked for
- ghost · Bitnami
The same CVE-2026-29053 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source platform designed for publishing and managing content, primarily focused on blogging. It offers a user-friendly interface, customizable themes, and a rich ecosystem of plugins. However, certain versions of Ghost are susceptible to vulnerabilities that allow attackers to execute arbitrary code through malicious themes, posing significant security risks to users.
Vulnerability Detail
The vulnerability in Ghost arises from the ability of specifically crafted malicious themes to execute arbitrary code on the server. This issue affects versions from v0.7.2 to v6.19.0, allowing attackers to potentially compromise the integrity and confidentiality of the server. The vulnerability is classified under CWE-74, which pertains to improper neutralization in command arguments, leading to remote code execution.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.19.1
This is the first release that contains the fix.
npm install ghost@6.19.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Ghost recommends that users refrain from installing untrusted themes. If a malicious theme has already been installed, it is advised to uninstall the theme and inspect its contents to understand its impact. This can be done through the Ghost admin interface or by removing the theme files directly from the server.
Conclusion
In summary, the Ghost platform has a critical vulnerability that allows remote code execution through malicious themes in versions up to 6.19.0. Users are strongly advised to update to version 6.19.1 or later to mitigate this risk. Additionally, maintaining vigilance regarding theme sources is essential for security.
See every vulnerability recorded for ghost →
FAQ
The vulnerability affects Ghost versions from v0.7.2 to v6.19.0.
The vulnerability has a CVSS score of 7.6, indicating a high severity level.
You can check your Ghost version in the admin panel or by running 'npm list ghost' in your terminal.
If updating is not possible, ensure that you do not install untrusted themes and remove any potentially malicious themes from your installation.
Vulert can monitor your application for open-source vulnerabilities in real-time using just the package-lock.json file, providing alerts for any detected issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
