CVE-2026-53943

Name of the Vulnerable Software and Affected Versions Ghost versions prior to 6.37.0

Description Ghost is a Node.js content management system. When deployed behind a shared caching layer that shares content between different visitors, an unauthenticated user can send an x-ghost-preview header to alter the rendered frontend response. This response may be stored and served to subsequent visitors requesting the same page, leading to cache poisoning of request-specific preview output. If the frontend and admin panel are hosted on the same domain, this can be used to take over staff user accounts. This issue can lead to Cross-Site Scripting (XSS), where an attacker injects malicious scripts into web pages viewed by other users.

Recommendations Update to version 6.37.0.