CVE-2025-9862: Ghost Package Vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark
Summary
CVE-2025-9862: Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark. Affects ghost across 2 version ranges.
>= 5.99.0, < 5.130.4
>= 6.0.0, < 6.0.9
Fixed in 5.130.4 or 6.0.9, depending on the release line you run. How to fix ↓
Also tracked for
- ghost · Bitnami
The same CVE-2025-9862 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular open-source publishing platform designed for creating and managing online content. It offers features like a user-friendly editor, customizable themes, and a robust API for developers. However, it has recently been found to have a vulnerability that allows unauthorized data access through its oEmbed mechanism.
Vulnerability Detail
The vulnerability arises from Ghost's oEmbed mechanism, which can be exploited by staff users to perform Server Side Request Forgery (SSRF) attacks. This allows attackers to exfiltrate sensitive data from internal systems, posing a significant security risk. The affected versions include Ghost v5.99.0 to v5.130.3 and v6.0.0 to v6.0.8, with the issue being fixed in versions v5.130.4 and v6.0.9.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.99.0, < 5.130.45.130.4npm install ghost@5.130.4 -
>= 6.0.0, < 6.0.96.0.9npm install ghost@6.0.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, restrict access to the oEmbed functionality for staff users until the package can be updated. This can be done by modifying user permissions in the Ghost admin panel.
Conclusion
The Ghost package has a moderate vulnerability (CVE-2025-9862) that allows SSRF attacks through its oEmbed mechanism. It is crucial for users to update to the patched versions to secure their applications and prevent potential data exfiltration.
See every vulnerability recorded for ghost →
FAQ
CVE-2025-9862 is a vulnerability in the Ghost package that allows staff users to perform Server Side Request Forgery (SSRF) attacks via the oEmbed mechanism.
The affected versions are Ghost v5.99.0 to v5.130.3 and v6.0.0 to v6.0.8.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Update your Ghost package to version 5.130.4 or 6.0.9 using the command: npm install ghost@5.130.4 or npm install ghost@6.0.9.
Yes, you can restrict access to the oEmbed functionality for staff users until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
