CVE-2026-29053

Ghost CMS CVE-2026-29053 affects Ghost 0.7.2–6.19.0, with a server-side code execution via malicious themes. The root cause is an unsafe Handlebars/jsonpath flow: the get helper could traverse the prototype chain, allowing a theme to execute arbitrary code on the server. The issue is fixed in Gho...

CVE-2026-29053 Ghost Vulnerable to Remote Code Execution via Malicious Themes

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1...

CVE-2026-26980

CVE-2026-26980 is Ghost CMS unauthenticated SQL injection in the Content API (pre-6.19.1). Affected Ghost versions are 3.24.0 through 6.19.0; fixed in 6.19.1. The vulnerability allows reading arbitrary data from the database, with reports indicating attackers can exfiltrate sensitive data such as...