Is CVE-2026-22596 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22596 being exploited in the wild.

How severe is CVE-2026-22596?

Low severity, with a CVSS score of 3.1, published 8 January 2026.

Which products and versions are affected?

ghost (npm) SEMVER:introduced=6.0.0,fixed=6.11.0.

Is there a fix for CVE-2026-22596?

Yes. ghost (npm): upgrade to 6.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22596 attacked?

It is attacked over the network.

Am I affected by CVE-2026-22596?

Check whether you run ghost (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22596: Ghost SQL injection in Members Activity Feed

CVE-2026-22596 · Severity: low · CVSS 3.1 · Published 2026-01-08

Ghost is a popular content management system and blogging platform. A SQL injection vulnerability in Ghost's admin API members events endpoint allows authenticated administrators to execute arbitrary database queries, potentially exposing or modifying member data and other sensitive information stored in the database.

Technologies: ghost (npm). Vendors: npm.

Quick answers

Is CVE-2026-22596 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22596 being exploited in the wild.
How severe is CVE-2026-22596?: Low severity, with a CVSS score of 3.1, published 8 January 2026.
Which products and versions are affected?: ghost (npm) SEMVER:introduced=6.0.0,fixed=6.11.0.
Is there a fix for CVE-2026-22596?: Yes. ghost (npm): upgrade to 6.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22596 attacked?: It is attacked over the network.
Am I affected by CVE-2026-22596?: Check whether you run ghost (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ghost (npm): upgrade to 6.11.0 or later
```
npm install ghost@6.11.0
```

Technical details

The vulnerability is a SQL injection (CWE-89) in Ghost's /ghost/api/admin/members/events endpoint. The flaw allows users with valid Admin API credentials to inject arbitrary SQL commands through insufficiently sanitized input parameters. The attack vector is network-based and requires high privileges (Admin API authentication); no user interaction is needed. An attacker with admin credentials can read, modify, or delete database records. Patches are available in Ghost v5.130.6 and v6.11.0.

Affected products

Ghost Ghost 5.90.0 to 5.130.5, 6.0.0 to 6.10.3

Identifiers

CVE-2026-22596
GHSA-gjrp-xgmh-x9qq

Timeline

2026-01-08: disclosed: Vulnerability published
2026-01-08: patched: Patches released: Ghost v5.130.6 and v6.11.0

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-gjrp-xgmh-x9qq

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.