CVE-2026-29053

9.8 criticalEPSS 4.9%

Critical (9.8) in ghost ghost. EPSS 4.9% chance of exploitation in the next 30 days. Fixed in ghost 6.19.1.

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.9% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2026-03-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ghost:ghost

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-cgc2-rcrh-qr5x	npm	ghost	>=0.7.2 <6.19.1	6.19.1

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-cgc2-rcrh-qr5x

Check your stack JSON