Skip to content
OpenAdvisories

Package · npm

ghost

62 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.7
    CVE-2026-29053 Public exploit

    Ghost Vulnerable to Remote Code Execution via Malicious Themes

    Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

    TryGhost Ghost ghost npm
  • High 8.1
    CVE-2026-22594 Public exploit

    Ghost has Staff 2FA bypass

    Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.

    TryGhost Ghost ghost npm
  • High 7.5
    CVE-2023-32235 Public exploit EPSS 39%

    Path Traversal in Ghost

    Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.

    ghost npm