Description
Ghost before 5.82.0 allows CSV Injection during a member CSV export.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @tryghost/members-csv | < 5.82.0 | 5.82.0 | GHSA-xgwh-cgv9-783v |
High · 8.8
CVE-2024-34448
BIT-ghost-2024-34448EUVD-2024-1862GHSA-xgwh-cgv9-783v
Ghost allows CSV Injection during member CSV export
Published May 22, 2024 · Updated Feb 13, 2025 · Assigned by mitre