PT-2026-103809

CVE-2026-103277

Published

2026-10-01

Updated

2026-10-09

Description by

CVSS 4.0

8.6

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ghost versions 2.5.0 through 6.33.x

Description The oEmbed preview feature fails to sandbox externally hosted scripts, allowing for untrusted script execution. An attacker can create malicious oEmbed content to execute scripts within the administrative session of a staff user, which may lead to the compromise of administrative access.

Recommendations Update Ghost to version 6.34.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jorian Woltjer

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers