CVE-2026-105642: Ghost Package Remote Code Execution via Bookmark Card Images
Summary
CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images. Affects ghost versions >= 6.56.0, < 6.67.0. Fixed in 6.67.0. How to fix ↓
Also tracked for
- ghost · npm
The same CVE-2026-105642 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular Node.js content management system designed for professional publishing. It allows users to create and manage content easily, offering features like a customizable editor, themes, and plugins. However, versions 6.56.0 to 6.67.0 of Ghost contain a vulnerability in its bundled image processing library, specifically in how it handles SVG files.
Vulnerability Detail
The vulnerability arises from the improper handling of SVG images in the Ghost content management system. Any staff user, including those with limited permissions such as Contributors, can create a bookmark card for a website controlled by an attacker. This action can lead to arbitrary commands being executed on the Ghost server, posing a significant security risk. The vulnerability has a CVSS score of 9.8, indicating a high severity level, and affects the integrity and availability of the system.
How To Fix
Minimum fixed version
6.67.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Ghost admin interface to trusted users only. This can help mitigate the risk until the package is updated. Additionally, consider disabling the bookmark card feature if it is not essential for your use case.
Conclusion
The vulnerability CVE-2026-105642 in the Ghost content management system poses a serious risk due to improper SVG handling, allowing remote code execution. It is crucial to update to version 6.67.0 or later to mitigate this risk. Until then, implement workarounds to protect your system.
See every vulnerability recorded for ghost →
FAQ
CVE-2026-105642 is a vulnerability in the Ghost content management system that allows remote code execution through improperly handled SVG images.
Versions 6.56.0 to 6.67.0 of Ghost are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update Ghost immediately, restrict access to the admin interface and consider disabling the bookmark card feature as a temporary workaround.
The vulnerability can lead to arbitrary code execution on the server, potentially compromising the entire system and allowing attackers to manipulate or steal sensitive data.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
