VulertSecurity VulertSecurity

Vulnerability Database · npm · ghost · Version

ghost 6.62.0

6.62.0 is affected by 19 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 2 High 8 Medium 8 Low 1 Unrated 0

All ghost versions & vulnerabilities → Source repository Search the database for this package →
Released 01 Sep 2026 Licence MIT Also known from other sources 16 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

ghost 6.62.0 vulnerabilities

19 vulnerabilities cover ghost 6.62.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2022-27139: Arbitrary File Upload in Ghost 9.8 critical No fix published 13 Apr 2022
CVE-2022-28397: Arbitrary File Upload in Ghost CMS 9.8 critical No fix published 13 Apr 2022
CVE-2026-105642: Ghost Remote Code Execution via Bookmark Card Images 8.8 high 6.67.0 07 Oct 2026
CVE-2026-104414: Ghost Stored XSS Vulnerability via oEmbed Photo Responses 8.1 high 6.64.0 07 Oct 2026
CVE-2026-104416: Ghost Package - Invite Token Disclosure in Admin API 7.5 high 6.64.0 07 Oct 2026
CVE-2026-105643: Ghost Stored XSS via Embed Card Previews 7.3 high 6.67.0 07 Oct 2026
CVE-2026-105649: Ghost Stored XSS Vulnerability via SVG Uploads 7.3 high 6.65.0 07 Oct 2026
CVE-2026-104413: Ghost Stored XSS via Bookmark Card Images 7.3 high 6.64.0 07 Oct 2026
CVE-2026-104411: Ghost Stored XSS Vulnerability via File Uploads 7.3 high 6.64.0 07 Oct 2026
CVE-2026-104418: Ghost Remote Code Execution via Theme Translation Files 7.2 high 6.64.0 07 Oct 2026
CVE-2026-105644: Ghost Stored XSS Vulnerability via SVG Files in Content Imports 6.8 medium 6.67.0 07 Oct 2026
Possible Cross-site Scripting Issue in Ghost 6.5 medium No fix published 11 Feb 2024
CVE-2026-105645: Ghost Package Suffers from Regular Expression Denial of Service Vulnerability 4.9 medium 6.67.0 07 Oct 2026
CVE-2026-105646: Ghost Package Suffers from Regular Expression Denial of Service in Content Import 4.9 medium 6.67.0 07 Oct 2026
CVE-2026-104417: Ghost Path Traversal Vulnerability Exposing Server Secrets 4.9 medium 6.64.0 07 Oct 2026
CVE-2026-104412: Ghost Package Allows Editors to Elevate User Roles Improperly 4.3 medium 6.64.0 07 Oct 2026
CVE-2026-105647: Ghost Package Server-Side Request Forgery Vulnerability in Bookmark Fetching 4.0 medium 6.65.0 07 Oct 2026
CVE-2026-105648: Ghost Package Vulnerability - Private IP Filtering Bypass via IPv6 Transition Addresses 4.0 medium 6.65.0 07 Oct 2026
CVE-2026-104415: Ghost Package Password Hash Ordering Disclosure Vulnerability 3.1 low 6.64.0 07 Oct 2026

Looking for another version, or everything Vulert holds for ghost?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About ghost 6.62.0

Is ghost 6.62.0 vulnerable?

Yes. 19 vulnerabilities in the Vulert database cover ghost 6.62.0: 2 critical, 8 high, 8 medium and 1 low. Each entry above names the fixed version to move to.

Is 6.62.0 the latest release of ghost?

No. 6.62.0 was published 01 Sep 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor ghost for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the ghost version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.