CVE-2026-26980

Name of the Vulnerable Software and Affected Versions Ghost versions 3.24.0 through 6.19.0

Description A blind SQL injection exists in the Content API of Ghost, a Node.js content management system. The issue stems from the use of string concatenation instead of parameterized queries when processing user input in the slug filter, allowing unauthenticated attackers to perform arbitrary reads from the database. This flaw was exploited in a large-scale campaign affecting over 700 domains, including high-profile institutions like Harvard and Oxford Universities. Attackers used the /ghost/api/content/tags/ endpoint to steal Admin API keys, which granted them the ability to modify site content. This was used to inject malicious JavaScript loaders that executed "ClickFix" social engineering attacks, deceiving visitors into running harmful commands on their local machines to install infostealers and Remote Access Trojans (RATs).

Recommendations Update Ghost to version 6.19.1 or later. Rotate all Admin API keys. Inspect article content at the database level to identify and remove injected scripts. Review Admin API call logs for unauthorized bulk article modifications. As a temporary mitigation, use a reverse proxy or WAF rule to block Content API requests containing slug%3A%5B or slug:[ in the query string filter parameter.