p PatchFirst

CVE-2026-70588

CVE-2026-70588 · Ghost: Cross-Site Scripting in Universal Import

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1.

CVSS 5.0 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • ghost

    Versions
    • >= 5.26.0, < 6.54.1: Affected

    No fix published

  • ghost npm

    Affected ranges
    • SEMVER: ≥ 5.26.0, < 6.54.1

    Update to 6.54.1

Original sources

Check your server →