CVE-2026-53946

Name of the Vulnerable Software and Affected Versions Ghost versions 6.19.4 through 6.21.0

Description Ghost, a Node.js content management system, fails to restrict outbound HTTP requests when refetching missing image dimensions during post re-rendering. An authenticated staff user with permissions to create or edit posts can specify a URL in an image card pointing to an attacker-controlled host. This allows the server to make requests to internal networks or cloud instance metadata endpoints that are typically inaccessible from the public internet.

Recommendations Update Ghost to version 6.21.1.