Ghost: Stored cross-site scripting via oEmbed photo responses
Summary
Ghost, a Node.js publishing platform, contains a stored cross-site scripting vulnerability in its handling of oEmbed photo responses. An attacker can host a malicious oEmbed photo response; when a user embeds that URL, scripts are stored in post content and can run in the Ghost editor, on the published site and in newsletter emails. Successful exploitation can compromise staff admin sessions, and it requires that a user embeds the attacker's URL.
Affected
- Ghost 2.5.0 to before 6.64.0 (CNA record)
- The GitHub advisory states the issue is present from v2.1.0 up to v6.64.0; treat all versions below 6.64.0 as affected.
Fixed in
- Ghost 6.64.0 or later (vendor advisory GHSA-v3xr-g6p2-fvgv)
- Install the latest stable 6.x release, which includes the fix.
Workaround
- No vendor workaround documented.
- An unofficial aggregator suggests disabling oEmbed functionality as a temporary mitigation. This is not from the vendor and is unverified; use it only if patching is delayed and confirm with Ghost documentation first.
Exploitation
- No exploitation in the wild known.
- CISA SSVC data: exploitation none, automatable no.
- Not listed in KEV according to Strix.
- No public proof of concept confirmed.
Our recommendation
- Update all Ghost instances to 6.64.0 or later, including Docker and Ghost-CLI installs.
- Check that all staff accounts use multi-factor authentication.
- Rotate admin sessions after a password reset.
- Review recent posts and newsletters for unexpected scripts or content.
- Restrict admin access where possible and monitor for unusual admin activity.
- Check whether a managed hosting provider has already applied the fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-v3xr-g6p2-fvgv github.com
- VulnCheck advisory www.vulncheck.com
- OSV CVE-2026-104414 osv.dev
- OSV GHSA-v3xr-g6p2-fvgv osv.dev
- Ghost releases github.com
- OpenCVE CVE-2026-104414 app.opencve.io
- Strix CVE-2026-104414 www.strix.ai
- Winterflow Ghost releases winterflow.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:25.
Original description (NVD)
Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.