Remote Command Injection in sendmail Email Transport in Ghost
Summary
GHSA-wfrj-qqc2-83cm: Remote command injection when using sendmail email transport. Affects ghost versions < 4.15.0. Fixed in 4.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is an open-source publishing platform that is used to create and manage websites. It provides a range of features for content creation, management, and publication. The sendmail transport is a configuration option in Ghost that allows users to send emails using the Sendmail command-line tool. This vulnerability affects Ghost when the sendmail transport is explicitly used in the mail configuration.
Vulnerability Detail
The vulnerability in the sendmail transport of Ghost's mail configuration allows for remote command injection. This vulnerability is due to a flaw in the nodemailer dependency, which is used by Ghost for email functionality. An attacker can exploit this vulnerability by injecting malicious commands into the email content, leading to the execution of arbitrary commands on the server. This can result in unauthorized access, data leakage, or even complete compromise of the affected system. The impact of this vulnerability is moderate, with a CVSS score of 5.8.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.15.0
This is the first release that contains the fix.
npm install ghost@4.15.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Ghost is not immediately feasible, an alternative workaround is to use a different email transport option in the Ghost configuration. The documentation for Ghost provides information on how to configure alternative email transports. By using a different transport, such as SMTP, the vulnerability can be avoided.
Conclusion
The remote command injection vulnerability in the sendmail transport of Ghost's mail configuration can be mitigated by upgrading to version 4.15.0 or later. Alternatively, users can switch to a different email transport option. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghost →
FAQ
Ghost is an open-source publishing platform used for creating and managing websites.
The sendmail transport is a configuration option in Ghost that allows users to send emails using the Sendmail command-line tool.
The vulnerability occurs due to a flaw in the nodemailer dependency used by Ghost. An attacker can inject malicious commands into the email content, leading to the execution of arbitrary commands on the server.
The potential consequences include unauthorized access, data leakage, and complete compromise of the affected system.
The recommended solution is to upgrade Ghost to version 4.15.0 or later, which includes a patch for the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
