CVE-2026-103277
Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
- State
- Published
- Severity
- 8.6 High
- Published
- Oct 1, 2026
- Updated
- Oct 1, 2026
- Reserved
- Sep 30, 2026
Description
Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially compromising administrative access.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
GhostTryGhost |
|
References
- GitHub Security Advisory (GHSA-8vhf-xxpj-4qrg)vendor-advisory
- VulnCheck Advisory: Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbedthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.