CVE-2026-29053 — Ghost Vulnerable to Remote Code Execution via Malicious Themes

CVE-2026-29053

Ghost Vulnerable to Remote Code Execution via Malicious Themes PUBLISHED

Description (CNA)

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

Affected (CNA)

Vendor / product	Versions
TryGhost / Ghost	affected >= 0.7.2, < 6.19.1

CWE

CWE-74

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-cgc2-rcrh-qr5x

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.