Ghost Package - Remote Code Execution Vulnerability
Summary
GHSA-7v28-g2pq-ggg8: Ghost vulnerable to remote code execution in locale setting change. Affects ghost across 2 version ranges.
< 4.48.2
>= 5.0.0, < 5.2.3
Fixed in 4.48.2 or 5.2.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ghost package is an open-source content management system (CMS) designed for creating and managing websites. It provides a user-friendly interface for publishing and editing content. However, a vulnerability has been discovered in Ghost that allows authenticated attackers to execute arbitrary commands by manipulating the locale input. This vulnerability can be exploited through the file upload functionality in the post editor.
Vulnerability Detail
The vulnerability in Ghost arises from an upstream library. By changing the locale setting, an attacker can abuse the locale input to execute arbitrary commands. This can lead to unauthorized access, data breaches, and potential compromise of the entire system. The vulnerability has been assigned the CVE ID CVE-2022-24785. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 6.6, indicating a moderate severity level.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.48.24.48.2npm install ghost@4.48.2 -
>= 5.0.0, < 5.2.35.2.3npm install ghost@5.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating Ghost is not immediately feasible, a temporary workaround is to block the POST /ghost/api/admin/settings/ endpoint. This will disable the ability to update settings for your site, including the locale input. However, this is not a permanent solution, and updating Ghost is strongly recommended to fully address the vulnerability.
Conclusion
The Ghost package is vulnerable to a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by manipulating the locale input. To mitigate this vulnerability, it is crucial to update Ghost to the patched versions (5.2.3 for 5.x sites and 4.48.2 for 4.x sites). If immediate updating is not possible, a temporary workaround is to block the POST /ghost/api/admin/settings/ endpoint. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghost →
FAQ
The vulnerability allows authenticated attackers to execute arbitrary commands, potentially leading to unauthorized access, data breaches, and compromise of the system.
To fix the vulnerability, update Ghost to the patched versions: 5.2.3 for 5.x sites and 4.48.2 for 4.x sites. These versions add validation to the locale input to prevent the execution of arbitrary files.
As a temporary workaround, you can block the POST /ghost/api/admin/settings/ endpoint to disable updating settings for your site. However, updating Ghost is the recommended solution.
The CVE ID for this vulnerability is CVE-2022-24785.
The vulnerability has a CVSS score of 6.6, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
