CVE-2026-105651: Ghost: Stored XSS via Bookmark Card Images
When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site’s domain, possibly resulting in compromise of other staff users’ admin sessions.
References
- github.com/TryGhost/Ghost/commit/b41fe3f2c399cef058e6b487782a0b2263e86c03
- github.com/TryGhost/Ghost/issues/30761
- github.com/TryGhost/Ghost/pull/30761
- github.com/TryGhost/Ghost/releases/tag/v6.64.0
- github.com/TryGhost/Ghost/security/advisories/GHSA-347q-26qq-h2p6
- github.com/advisories/GHSA-347q-26qq-h2p6
- nvd.nist.gov/vuln/detail/CVE-2026-105651
Code Behaviors & Features
Detect and mitigate CVE-2026-105651 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →