Executive brief
Ghost is a popular open-source blogging platform used to create and manage content websites. An attacker can inject malicious JavaScript code into post excerpts that executes in the browsers of users viewing post summaries, potentially stealing sessions, credentials, or performing actions on behalf of affected users.
Technical details
A cross-site scripting (XSS) vulnerability exists in Ghost's excerpt.js component prior to version 5.76.0, where user-controlled post excerpt text is rendered without proper HTML escaping. An attacker can craft a post with a malicious excerpt containing JavaScript payloads that will execute when the excerpt is displayed in post summaries. The attack requires no authentication or special privileges—any user able to create or edit posts can inject the payload. The vulnerability was fixed by applying lodash escape function to sanitize excerpt text before rendering, preventing HTML and script execution in post summaries.
Affected products
- Ghost Ghost before 5.76.0
Timeline
- 2024-01-21: disclosed
- 2024-01-20: patched: Fixed in version 5.76.0