CVE-2026-29053: Ghost Vulnerable to Remote Code Execution via Malicious Themes
Impact
Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.
Vulnerable Versions
This vulnerability is present in Ghost v0.7.2 to v6.19.0.
Patches
v6.19.1 contains a fix for this issue.
Workarounds
Ghost generally recommends users refrain from installing untrusted themes. If a malicious theme has already been installed, it is recommended to uninstall the theme and then inspect it to understand its impact, which will be attack-specific.
References Ghost thanks Cristian-Alexandru Staicu at Endor Labs for disclosing this vulnerability responsibly.
For more information
If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Other sources
Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29053?
CVE-2026-29053 has a high severity due to the potential for remote code execution on affected servers.
How do I fix CVE-2026-29053?
To fix CVE-2026-29053, upgrade your Ghost installation to version 6.19.1 or later.
Which versions are affected by CVE-2026-29053?
CVE-2026-29053 affects Ghost versions from 0.7.2 to 6.19.0.
What can attackers do with CVE-2026-29053?
Attackers can execute arbitrary code on servers running vulnerable versions of Ghost through malicious themes.
Is there a workaround for CVE-2026-29053?
There is no known workaround; upgrading to the patched version is recommended to mitigate the risk.