Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-29053

Ghost Vulnerable to Remote Code Execution via Malicious Themes

Description

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TryGhost Ghost

  • >= 0.7.2, < 6.19.1affected

References