GHSA-w52v-v783-gw97

Source

https://github.com/advisories/GHSA-w52v-v783-gw97

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w52v-v783-gw97/GHSA-w52v-v783-gw97.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w52v-v783-gw97

Aliases

Published

2026-02-18T21:50:23Z

Modified

2026-02-21T10:56:09.712635Z

Severity

9.4 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L CVSS Calculator

Summary

Ghost has a SQL injection in Content API

Details

Impact

A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database.

Vulnerable Versions

This vulnerability is present in Ghost v3.24.0 to v6.19.0.

Patches

v6.19.1 contains a fix for this issue.

Workarounds

There is no application-level workaround. The Content API key is public by design, so restricting key access does not mitigate this vulnerability.

As a temporary mitigation, a reverse proxy or WAF rule can be used to block Content API requests containing slug%3A%5B or slug:[ in the query string filter parameter. Note that this may break legitimate slug filter functionality.

References

We thank Nicholas Carlini using Claude, Anthropic for disclosing this vulnerability responsibly.

For more information

If you have any questions or comments about this advisory, email us at security@ghost.org.

Database specific

{
    "nvd_published_at": "2026-02-20T02:16:54Z",
    "github_reviewed_at": "2026-02-18T21:50:23Z",
    "github_reviewed": true,
    "severity": "CRITICAL",
    "cwe_ids": [
        "CWE-89"
    ]
}

References

Affected packages

npm / ghost

Package

Name: ghost; View open source insights on deps.dev
Purl: pkg:npm/ghost

Affected ranges

Type: SEMVER
Events: Introduced

3.24.0

Fixed

6.19.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w52v-v783-gw97/GHSA-w52v-v783-gw97.json"