CVE-2026-24778: Ghost vulnerable to XSS via malicious Portal preview links

January 28, 2026

An attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim’s permissions, potentially leading to account takeover.

References

github.com/TryGhost/Ghost
github.com/TryGhost/Ghost/commit/da858e640e88e69c1773a7b7ecdc2008fa143849
github.com/TryGhost/Ghost/security/advisories/GHSA-gv6q-2m97-882h
github.com/advisories/GHSA-gv6q-2m97-882h
nvd.nist.gov/vuln/detail/CVE-2026-24778

Code Behaviors & Features

Detect and mitigate CVE-2026-24778 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →