CVE-2026-105651

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105651
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105651.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105651
Aliases
Published
2026-10-05T19:09:44Z
Modified
2026-10-07T02:47:26Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Ghost: Stored XSS via Bookmark Card Images
Details

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-434",
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105651.json"
}
References

Affected packages

Git / github.com/tryghost/ghost

Affected ranges

Type
GIT
Repo
https://github.com/tryghost/ghost
Events
Introduced
18cc8dc7fb3ac90c087437e467583b04cfffabc0
Fixed
b41fe3f2c399cef058e6b487782a0b2263e86c03
Fixed
2fa451a7dca010016608065ad33bcc58c0043070
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "5.94.0"
        },
        {
            "fixed": "6.64.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v5.*
v5.100.0
v5.101.0
v5.101.4
v5.101.6
v5.102.0
v5.103.0
v5.104.0
v5.105.0
v5.106.0
v5.106.1
v5.107.0
v5.108.0
v5.108.1
v5.109.0
v5.109.3
v5.109.6
v5.110.0
v5.110.2
v5.111.0
v5.112.0
v5.113.0
v5.114.0
v5.115.1
v5.116.0
v5.116.2
v5.117.0
v5.118.0
v5.118.1
v5.119.0
v5.119.2
v5.120.0
v5.120.2
v5.121.0
v5.122.0
v5.125.1
v5.126.0
v5.127.0
v5.127.1
v5.128.0
v5.129.0
v5.129.1
v5.129.2
v5.130.0
v5.130.1
v5.94.0
v5.94.1
v5.94.2
v5.95.0
v5.96.0
v5.96.1
v5.97.0
v5.98.0
v5.99.0
v6.*
v6.0.0
v6.0.0-alpha.2
v6.0.0-rc.0
v6.0.0-rc.1
v6.0.0-rc.2
v6.0.0-rc.3
v6.0.1
v6.0.10
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.0.7
v6.0.8
v6.1.0
v6.10.0
v6.10.3
v6.11.0
v6.12.0
v6.13.0
v6.13.1
v6.13.2
v6.14.0
v6.15.0
v6.16.0
v6.16.1
v6.17.0
v6.17.1
v6.18.0
v6.18.2
v6.19.0
v6.19.1
v6.19.2
v6.19.3
v6.19.4
v6.2.0
v6.20.0
v6.20.1
v6.21.0
v6.21.1
v6.21.2
v6.22.0
v6.22.1
v6.23.0
v6.24.0
v6.25.0
v6.25.1
v6.26.0
v6.27.0
v6.28.0
v6.29.0
v6.29.1
v6.3.0
v6.3.1
v6.30.0
v6.31.0
v6.32.0
v6.33.0
v6.34.0
v6.35.0
v6.36.0
v6.37.0
v6.37.1
v6.38.0
v6.39.0
v6.4.0
v6.40.0
v6.41.0
v6.41.1
v6.42.0
v6.43.0
v6.43.1
v6.44.0
v6.44.1
v6.45.0
v6.46.0
v6.47.0
v6.48.0
v6.49.0
v6.5.0
v6.5.2
v6.5.3
v6.50.0
v6.51.0
v6.52.0
v6.52.1
v6.53.0
v6.54.0
v6.54.1
v6.55.0
v6.56.0
v6.57.0
v6.57.1
v6.58.0
v6.59.0
v6.6.0
v6.60.0
v6.61.0
v6.62.0
v6.63.0
v6.7.0
v6.8.0
v6.8.1
v6.9.0
v6.9.2
v6.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105651.json"