Description
Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TryGhost | Ghost | 5.94.0 – < 6.64.0 | 6.64.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ghost | >= 5.94.0, < 6.64.0 | 6.64.0 | GHSA-347q-26qq-h2p6 |
References
- GitHub Security Advisory (GHSA-347q-26qq-h2p6) vendor-advisory
- VulnCheck Advisory: Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images third-party-advisory