CVE-2026-70588 Ghost: Cross-Site Scripting in Universal Import
Attackers can inject malicious scripts via the Universal Import feature in Ghost Admin, potentially compromising user sessions and data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-70588?
CVE-2026-70588 is a medium-severity cross-site scripting vulnerability in TryGhost Ghost, published on 4 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-70588?
3 open source packages ship an affected version, including ghost.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 5.26.0 | 6.54.1 |
ghost npm | From 5.26.0 | 6.54.1 |
ghost npm | From 5.26.0 | 6.54.1 |
How do I fix CVE-2026-70588?
Upgrade ghost to 6.54.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-70588 being exploited?
There is no known exploitation of CVE-2026-70588 in the wild and no public exploit code.
Sources
Also known as BIT-ghost-2026-70588, GHSA-2gx6-7gx2-wwcf.