CVE-2026-103277: Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially compromising administrative access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.34.0
Event History
Frequently Asked Questions
Which deployments are affected?
Ghost versions from 2.5.0 before 6.34.0 are affected. The issue is in the oEmbed preview feature.
What must an attacker do to exploit this vulnerability?
An attacker must craft malicious oEmbed content and cause a staff user to interact with its preview. Exploitation requires user interaction but does not require prior privileges.
What is the impact of successful exploitation?
Malicious scripts can execute in the context of the staff user's Ghost admin session. This can potentially compromise administrative access, with high confidentiality and integrity impact.
What should be done to remediate the issue?
Upgrade Ghost to version 6.34.0 or later. The provided information does not specify an alternative mitigation for environments that cannot immediately upgrade.