cve.bz

CVE-2026-53950

7.5 highEPSS 0.4%

@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.

CVSS 3.1
7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-25)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-xpp7-93x6-v29mnpm@tryghost/activitypub<3.1.03.1.0

References

Check your stackJSON