---
id: CVE-2026-105651
title: Ghost is a Node.js content management system
summary: >-
  Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when
  creating a bookmark card, Ghost could store non-image files fetched from an
  external website as bookmark icons or thumbnails. This allowed any staff user,
  inclu…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-79
  - CWE-434
vendor: TryGhost
product: Ghost
affected:
  - 'Ghost >= 5.94.0, < 6.64.0'
patched:
  - ghost 6.64.0
published: '2026-10-05'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T22:17:02.423'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105651'
references:
  - url: >-
      https://github.com/TryGhost/Ghost/commit/b41fe3f2c399cef058e6b487782a0b2263e86c03
    label: security-advisories@github.com
  - url: 'https://github.com/TryGhost/Ghost/issues/30761'
    label: security-advisories@github.com
  - url: 'https://github.com/TryGhost/Ghost/releases/tag/v6.64.0'
    label: security-advisories@github.com
  - url: 'https://github.com/TryGhost/Ghost/security/advisories/GHSA-347q-26qq-h2p6'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105651'
  - url: 'https://github.com/TryGhost/Ghost/pull/30761'
  - url: 'https://github.com/advisories/GHSA-347q-26qq-h2p6'
tags:
  - nvd
  - cve.org
  - ghsa
  - npm
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-07T21:43:03.379087Z'
epss: 0.00302
epssPercentile: 0.22799
aliases:
  - GHSA-347q-26qq-h2p6
ecosystem: npm
ingestedAt: '2026-10-05T19:30:59.996Z'
---

## Overview

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-105651)

Affected packages:

- `ghost >= 5.94.0, < 6.64.0`

Patched in:

- `ghost 6.64.0`

Source: https://github.com/advisories/GHSA-347q-26qq-h2p6