CVE-2026-105645Medium· 4.9▾ SunlitGhost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access.…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.3%
Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
ghost >= 5.37.0, < 6.67.0Patched in:
ghost 6.67.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105646Medium· 4.9Ghost is a Node.js content management system
CVE-2026-105644Medium· 6.8Ghost is a Node.js content management system
CVE-2026-105682Low· 2.7Ghost is a Node.js content management system
CVE-2026-105683Low· 3.8Ghost is a Node.js content management system
CVE-2026-105679High· 7.3Ghost is a Node.js content management system
CVE-2026-105680Medium· 6.5Ghost is a Node.js content management system