Executive brief
Ghost is a popular open-source content management system used for blogging, newsletters, and publishing. The Universal Import feature, which allows administrators to bulk import content, failed to sanitize HTML in imported data, enabling an authenticated attacker with administrative privileges to inject malicious scripts into post content. Once published, these scripts could execute in the browsers of readers viewing the affected posts, potentially leading to credential theft, session hijacking, or defacement.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Ghost's content import functionality, classified under CWE-79. The Universal Import feature failed to properly validate and sanitize imported HTML content before storing it in the database. The attack vector requires network access and high privileges (administrative account), with no user interaction needed from victims. An attacker with admin credentials can upload specially crafted import data containing XSS payloads that will be stored and later executed when posts are viewed by other users. The vulnerability affects Ghost versions 5.26.0 through 6.54.0. A fix was released in version 6.54.1 that hardens content validation and imports the DOMPurify library for improved HTML sanitization.
Affected products
- TryGhost Ghost 5.26.0 to 6.54.0
Timeline
- 2026-08-04: disclosed: Vulnerability disclosed via GitHub Advisory GHSA-2gx6-7gx2-wwcf
- 2026-07-27: patched: Fix merged in pull request #29635 with hardened content validation