CVE-2026-53950
CVE-2026-53950 · @tryghost/activitypub: XSS in Ghost's ActivityPub client
This page contains facts from public vulnerability sources. Check the original advisory before updating.
@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.
CVSS 7.5 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
ghost
- Versions
- < 3.1.0: Affected
No fix published
@tryghost/activitypub npm
- Affected ranges
- SEMVER: < 3.1.0
Update to 3.1.0