CVE-2026-103292: Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head
Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghosthead}} helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to compromise of a staff user's admin session when that user views the affected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.50.0
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the resulting script execution?
An authenticated Ghost user with limited privileges can inject the unescaped content. The primary impact described is compromise of a staff user's admin session when that staff user views a published page containing the injected payload.
Are published pages affected, or only the administrative interface?
The vulnerable data is emitted in the JSON-LD HTML tag by the {{ghost_head}} helper and is rendered as script in the published page. A staff user can therefore be exposed by viewing an affected published page.
Which Ghost versions need remediation?
Ghost versions from 0.5.3 through versions before 6.50.0 are affected. Upgrade to 6.50.0 or later.
How can I determine whether my instance may already contain a malicious payload?
Review content created or edited by limited-privilege authenticated users for unescaped content that reaches JSON-LD output on pages using the {{ghost_head}} helper. Pay particular attention to published pages that staff users may have viewed.