https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T16:54:32.279472+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-ghost-2026-29053 BIT-ghost-2026-29053 — Ghost Vulnerable to Remote Code Execution via Malicious Themes 2026-10-06T16:54:32.329035+00:00

Affected: Bitnami: ghost

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

 https://cve.radiocsirt.org/vuln/euvd-2026-274607 EUVD-2026-274607 2026-10-06T16:54:32.329098+00:00 EUVD-2026-274607 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29053 fkie_cve-2026-29053 2026-10-06T16:54:32.329115+00:00

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

 https://cve.radiocsirt.org/vuln/ghsa-cgc2-rcrh-qr5x GHSA-cgc2-rcrh-qr5x — Ghost Vulnerable to Remote Code Execution via Malicious Themes 2026-10-06T16:54:32.329138+00:00

Affected: npm: ghost

### Impact

Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.

### Vulnerable Versions

This vulnerability is present in Ghost v0.7.2 to v6.19.0.

### Patches

v6.19.1 contains a fix for this issue.

### Workarounds

Ghost generally recommends users refrain from installing untrusted themes. If a malicious theme has already been installed, it is recommended to uninstall the theme and then inspect it to understand its impact, which will be attack-specific.

### References Ghost thanks Cristian-Alexandru Staicu at Endor Labs for disclosing this vulnerability responsibly.

### For more information

If there are any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).