Skip to content
OpenAdvisories

Vendor

TryGhost

88 known vulnerabilities.

Products

Ghost 85 express-hbs 1 Ghost-CLI 1 ActivityPub 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.7
    CVE-2026-29053 Public exploit

    Ghost Vulnerable to Remote Code Execution via Malicious Themes

    Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

    TryGhost Ghost ghost npm
  • High 8.1
    CVE-2026-22594 Public exploit

    Ghost has Staff 2FA bypass

    Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.

    TryGhost Ghost ghost npm