Skip to content
OpenAdvisories

Package · npm

@tryghost/portal

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.8
    CVE-2026-24778

    Ghost vulnerable to XSS via malicious Portal preview links

    Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with th…

    TryGhost Ghost ghost @tryghost/portal npm
  • Medium 6.5
    CVE-2024-43409

    Ghost's improper authentication allows access to member information and actions

    Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.…

    TryGhost Ghost ghost @tryghost/portal npm