CVE-2021-29484: DOM XSS in Ghost Theme Preview
Summary
CVE-2021-29484: DOM XSS in Theme Preview. Affects ghost versions >= 4.0.0, < 4.3.3. Fixed in 4.3.3. How to fix ↓
Also tracked for
- ghost · Bitnami
The same CVE-2021-29484 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghost is an open-source publishing platform designed for creating and managing websites. It provides a user-friendly interface for content creation and administration. The vulnerability identified as CVE-2021-29484 affects Ghost versions 4.0.0 to 4.3.2. This vulnerability allows untrusted users to gain unauthorized access to the Ghost Admin interface by tricking logged-in users into clicking a malicious link. The attackers can exploit this vulnerability without requiring the users to enter their credentials, making it a critical security concern.
Vulnerability Detail
The unused endpoint introduced during the development of Ghost 4.0.0 is the root cause of this vulnerability. By clicking a link containing malicious code, untrusted users can bypass authentication and gain access to the Ghost Admin interface. This can lead to unauthorized modifications to the website, exposure of sensitive information, and potential compromise of the entire Ghost installation. The vulnerability has a CVSS score of 6.8, indicating a moderate level of severity.
How To Fix
Latest published version: 6.72.0 as of 22 Oct 2026
npm install ghost@6.72.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.3.3
This is the first release that contains the fix.
npm install ghost@4.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrade is not possible, the following workaround can be implemented to mitigate the risk:
- Log out of Ghost Admin.
- Suspend any users who cannot log out.
- Block access to the '/ghost/preview' endpoint.
Example of how to block access in nginx:
location ~ /ghost/preview {
rewrite ^(/(.*/)?ghost/)(.*)$ $1 redirect;
}
Conclusion
The vulnerability identified as CVE-2021-29484 in Ghost versions 4.0.0 to 4.3.2 allows untrusted users to gain unauthorized access to the Ghost Admin interface. It is crucial to upgrade to Ghost version 4.3.3 or later to fix this vulnerability. Self-hosters should also implement the provided workaround to block access to the vulnerable endpoint. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ghost →
FAQ
This vulnerability allows untrusted users to gain unauthorized access to the Ghost Admin interface, potentially leading to unauthorized modifications, exposure of sensitive information, and compromise of the entire Ghost installation.
Ghost(Pro) has already been patched and is not affected by this vulnerability. There is no evidence of exploitation prior to the patch being applied.
Self-hosters running Ghost versions between 4.0.0 and 4.3.2 should upgrade to version 4.3.3 or later as soon as possible. Additionally, they can implement the provided workaround to block access to the vulnerable endpoint.
The recommended mitigation strategy is to upgrade Ghost to version 4.3.3 or later. If immediate upgrade is not possible, self-hosters should follow the provided workaround and take necessary precautions to secure their Ghost installations.
For more information, you can refer to the official forum post on Ghost.org: https://forum.ghost.org/t/critical-security-update-available-for-ghost-4-x/22290
References
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
