Ghost: Untrusted script execution in oEmbed preview of the editor
Summary
Ghost versions from 2.5.0 before 6.34.0 do not sandbox externally hosted scripts in the editor's oEmbed preview. An attacker who gets a staff user to view crafted oEmbed content can run scripts in that user's admin session, which may compromise administrative access. The vendor's 6.34.0 fix was reported to be bypassed by CVE-2026-105643, which is fixed in 6.67.0.
Affected
- Ghost from 2.5.0 before 6.34.0 (vendor advisory GHSA-8vhf-xxpj-4qrg)
- Ghost from 6.34.0 before 6.67.0 per the follow-up issue CVE-2026-105643 (bypass of the 6.34.0 fix)
- Related issue CVE-2026-105650 (stored XSS via oEmbed photo responses) affects Ghost from 2.5.0 before 6.64.0
Fixed in
- Ghost 6.34.0 (vendor fix for CVE-2026-103277)
- Ghost 6.67.0 or later (fix for the bypass CVE-2026-105643, reported by a third party; confirm in Ghost release notes)
Workaround
No workaround listed by the vendor or VulnCheck. Patching is the fix.
- Interim measures: limit staff accounts, avoid previewing untrusted embeds in the editor, and review recent post edits.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept found.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory all Ghost instances and versions, including self-hosted and hosting-provider installs.
- Upgrade to Ghost 6.67.0 or later, not only 6.34.0.
- Remove unused staff accounts and enforce MFA on admin logins.
- Check admin logs for unexpected logins or changes, and rotate integration API keys if compromise is suspected.
- Prioritise self-hosted instances with multiple staff accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8vhf-xxpj-4qrg github.com
- VulnCheck advisory: Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed www.vulncheck.com
- GitLab advisory CVE-2026-105643 (bypass of the oEmbed fix) advisories.gitlab.com
- CVE Reports: CVE-2026-105643 cvereports.com
- GitLab advisory CVE-2026-105650 (stored XSS via oEmbed photo responses) advisories.gitlab.com
- OSV entry CVE-2026-103277 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:32.
Original description (NVD)
Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially compromising administrative access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.