p PatchFirst

PatchFirst · Latest vulnerabilities

@tryghost/activitypub vulnerabilities

Vulnerabilities published for @tryghost/activitypub in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-53950

    High · CVSS 7.5EPSS 0.35%Fix available

    @tryghost/activitypub: XSS in Ghost's ActivityPub client

    @tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.

    @tryghost/activitypubNode.js
    • Update to 3.1.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →