CVE-2026-105642: Ghost: Remote Code Execution via Bookmark Card Images

October 7, 2026

An image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server.

References

github.com/TryGhost/Ghost/security/advisories/GHSA-788w-68h3-cvxp
github.com/advisories/GHSA-788w-68h3-cvxp
nvd.nist.gov/vuln/detail/CVE-2026-105642

Code Behaviors & Features

Detect and mitigate CVE-2026-105642 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →