CVE-2026-103292

Description

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_head}} helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to compromise of a staff user's admin session when that user views the affected page.

CVSS Vector

References

• https://github.com/TryGhost/Ghost/security/advisories/GHSA-mp9q-4q6m-44f5
• https://www.vulncheck.com/advisories/ghost-0.5.3-before-6.50.0-cross-site-scripting-via-ghost-head