Advisories for Npm/@Tryghost/Activitypub package

The ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server.