p PatchFirst

CVE-2026-29053

CVE-2026-29053 · Ghost Vulnerable to Remote Code Execution via Malicious Themes

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

CVSS 7.7 · High · EPSS 5.1% · Public exploit · Fix available

Published
Updated

Stack: node

Affected products and versions

  • ghost

    Versions
    • >= 0.7.2, < 6.19.1: Affected

    No fix published

  • ghost npm

    Affected ranges
    • SEMVER: ≥ 0.7.2, < 6.19.1

    Update to 6.19.1

Original sources

Check your server →