CVE-2026-105643 Ghost: Stored XSS via Embed Card Previews
Stored XSS in Ghost CMS allows staff users to inject scripts via embed cards, potentially compromising other users' admin sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-105643?
CVE-2026-105643 is a high-severity cross-site scripting vulnerability in TryGhost Ghost, published on 5 Oct 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, potentially compromising that user’s admin session. Self-hosted sites should leave the new security.embedPreviewUrl configuration option at its default value. This issue is fixed in version 6.67.0.
Which versions are affected by CVE-2026-105643?
3 open source packages ship an affected version, including ghost.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 6.34.0 | 6.67.0 |
ghost npm | From 6.34.0 | 6.67.0 |
ghost npm | From 6.34.0 | 6.67.0 |
How do I fix CVE-2026-105643?
Upgrade ghost to 6.67.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-105643 being exploited?
There is no known exploitation of CVE-2026-105643 in the wild and no public exploit code.
Sources
Also known as BIT-ghost-2026-105643, GHSA-69qc-f5m6-889c, MINI-xwxf-9hp6-vw63.