← CVE Intelligence

CVE-2026-53950

@tryghost/activitypub: XSS in Ghost's ActivityPub client PUBLISHED

Description (CNA)

@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.

Affected (CNA)

Vendor / productVersions
TryGhost / Ghostaffected < 3.1.0

CWE

CWE-79

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.