BIT-ghost-2026-29053

vendorUSosv

Ghost Vulnerable to Remote Code Execution via Malicious Themes

view advisory published 2026-03-07Licence: per source

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-29053US	critical9.8	4.83% (92nd)	Exploit	2026-03-05
Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue…

references

External citations — patches, advisories, analysis.

https://github.com/TryGhost/Ghost/security/advisories/GHSA-cgc2-rcrh-qr5xADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-29053WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan