CVE-2026-103277 Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
Attackers can execute malicious scripts in admin sessions via oEmbed, potentially compromising administrative access in Ghost CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-103277?
CVE-2026-103277 is a high-severity cross-site scripting vulnerability in TryGhost Ghost, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially compromising administrative access.
Weakness: CWE-79
Which versions are affected by CVE-2026-103277?
1 open source package ship an affected version, including ghost.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 2.5.0 | 6.34.0 |
How do I fix CVE-2026-103277?
Upgrade ghost to 6.34.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-103277 being exploited?
There is no known exploitation of CVE-2026-103277 in the wild and no public exploit code.
Sources
Also known as BIT-ghost-2026-103277, GHSA-8vhf-xxpj-4qrg, GHSA-h526-5mvq-49p7.