VulertSecurity VulertSecurity

Vulnerability Database · npm · ghost · Version

ghost 6.12.0

6.12.0 is affected by 34 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 4 High 7 Medium 21 Low 2 Unrated 0

All ghost versions & vulnerabilities → Source repository Search the database for this package →
Released 09 Jan 2026 Licence MIT Also known from other sources 32 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

ghost 6.12.0 vulnerabilities

34 vulnerabilities cover ghost 6.12.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2022-27139: Arbitrary File Upload in Ghost 9.8 critical No fix published 13 Apr 2022
CVE-2022-28397: Arbitrary File Upload in Ghost CMS 9.8 critical No fix published 13 Apr 2022
CVE-2026-53943: Ghost Cache-Poisoning XSS Vulnerability in Ghost Package 9.6 critical 6.37.0 01 Jul 2026
CVE-2026-26980: Ghost SQL Injection Vulnerability in Content API 9.4 critical 6.19.1 18 Feb 2026
CVE-2026-104414: Ghost Stored XSS Vulnerability via oEmbed Photo Responses 8.1 high 6.64.0 07 Oct 2026
CVE-2026-29053: Ghost Package Vulnerable to Remote Code Execution via Malicious Themes 7.6 high 6.19.1 03 Mar 2026
CVE-2026-104416: Ghost Package - Invite Token Disclosure in Admin API 7.5 high 6.64.0 07 Oct 2026
CSRF Vulnerability in Ghost Package: Incomplete Protections Around OTC Usage 7.5 high 6.19.3 05 Mar 2026
CVE-2026-105649: Ghost Stored XSS Vulnerability via SVG Uploads 7.3 high 6.65.0 07 Oct 2026
CVE-2026-104413: Ghost Stored XSS via Bookmark Card Images 7.3 high 6.64.0 07 Oct 2026
CVE-2026-104418: Ghost Remote Code Execution via Theme Translation Files 7.2 high 6.64.0 07 Oct 2026
CVE-2026-105644: Ghost Stored XSS Vulnerability via SVG Files in Content Imports 6.8 medium 6.67.0 07 Oct 2026
CVE-2026-70594: Ghost Package Session Fixation Vulnerability in Ghost Admin 6.7 medium 6.54.1 04 Aug 2026
CVE-2026-70593: Ghost Theme Upload Path Traversal Vulnerability 6.6 medium 6.54.1 04 Aug 2026
CVE-2026-105680: Ghost Package Authorization Flaw Allows Author Role to Delete Any Post 6.5 medium 6.60.0 07 Oct 2026
CVE-2026-103289: Ghost Package Authorization Bypass in Comments Feature 6.5 medium 6.44.1 07 Oct 2026
Possible Cross-site Scripting Issue in Ghost 6.5 medium No fix published 11 Feb 2024
CVE-2026-53944: Ghost Package Vulnerability Allows Bypass of Private IP Filtering 5.8 medium 6.21.1 04 Aug 2026
CVE-2026-70592: Ghost Database Backup Path Traversal Vulnerability 5.5 medium 6.54.1 04 Aug 2026
CVE-2026-53949: Ghost Package Vulnerability Allows Bypass of Content API Filters 5.3 medium 6.21.2 05 Aug 2026
CVE-2026-53947: Ghost Package Member Existence Leak via Magic Link Sign-In Response 5.3 medium 6.21.2 04 Aug 2026
CVE-2026-70588: Ghost Cross-Site Scripting Vulnerability in Universal Import 5.0 medium 6.54.1 04 Aug 2026
CVE-2026-105645: Ghost Package Suffers from Regular Expression Denial of Service Vulnerability 4.9 medium 6.67.0 07 Oct 2026
CVE-2026-105646: Ghost Package Suffers from Regular Expression Denial of Service in Content Import 4.9 medium 6.67.0 07 Oct 2026
CVE-2026-104417: Ghost Path Traversal Vulnerability Exposing Server Secrets 4.9 medium 6.64.0 07 Oct 2026
CVE-2026-70590: Ghost Package - Blind Password Hash Disclosure in Admin API 4.8 medium 6.54.1 04 Aug 2026
CVE-2026-70589: Ghost Package Allows Redemption of Archived Offers 4.8 medium 6.54.1 04 Aug 2026
CVE-2026-104412: Ghost Package Allows Editors to Elevate User Roles Improperly 4.3 medium 6.64.0 07 Oct 2026
CVE-2026-70596: Ghost Cross-Site Scripting Vulnerability in Feature Image Captions 4.3 medium 6.54.1 05 Aug 2026
CVE-2026-70591: Ghost Package Suffers from Server-Side Request Forgery Vulnerability 4.1 medium 6.54.1 04 Aug 2026
CVE-2026-105648: Ghost Package Vulnerability - Private IP Filtering Bypass via IPv6 Transition Addresses 4.0 medium 6.65.0 07 Oct 2026
CVE-2026-53945: Ghost Package Server-Side Request Forgery via DNS Rebinding 4.0 medium 6.21.2 04 Aug 2026
CVE-2026-104415: Ghost Package Password Hash Ordering Disclosure Vulnerability 3.1 low 6.64.0 07 Oct 2026
CVE-2026-103287: Ghost SSRF Vulnerability in Webhook Trigger 2.7 low 6.27.0 07 Oct 2026

Looking for another version, or everything Vulert holds for ghost?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About ghost 6.12.0

Is ghost 6.12.0 vulnerable?

Yes. 34 vulnerabilities in the Vulert database cover ghost 6.12.0: 4 critical, 7 high, 21 medium and 2 low. Each entry above names the fixed version to move to.

Is 6.12.0 the latest release of ghost?

No. 6.12.0 was published 09 Jan 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor ghost for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the ghost version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.