https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T08:29:55.787565+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-ghost-2026-53950 BIT-ghost-2026-53950 — @tryghost/activitypub: XSS in Ghost's ActivityPub client 2026-10-09T08:29:55.835475+00:00

Affected: Bitnami: ghost

@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.

 https://cve.radiocsirt.org/vuln/euvd-2026-330021 EUVD-2026-330021 2026-10-09T08:29:55.835538+00:00 EUVD-2026-330021 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53950 fkie_cve-2026-53950 2026-10-09T08:29:55.835555+00:00

@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.

 https://cve.radiocsirt.org/vuln/ghsa-xpp7-93x6-v29m GHSA-xpp7-93x6-v29m — XSS in Ghost's ActivityPub client 2026-10-09T08:29:55.835579+00:00

Affected: npm: @tryghost/activitypub

### Impact

The ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server.

### Vulnerable Versions

This vulnerability is present in the @tryghost/activitypub package up to v3.0.8. All prior versions are also affected.

### Patches

@tryghost/activitypub v3.1.0 contains a fix for this issue and is also automatically fetched by Ghost.

### References

Ghost thanks Brad Geesaman, Ghost Security for disclosing this vulnerability responsibly.

### For more information

If you have any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).