npm CVE Archive

ghost CVE Vulnerabilities

All known CVEs affecting ghost. Kodem’s runtime-powered SCA reveals which are actually reachable in your application.

Known vulnerabilities
CVE
Summary
Severity
CVE-2026-53943
Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header
Critical
CVE-2026-29784
Ghost has incomplete CSRF protections around OTC use
High
CVE-2026-29053
Ghost Vulnerable to Remote Code Execution via Malicious Themes
High
CVE-2026-26980
Ghost has a SQL injection in Content API
Critical
CVE-2026-24778
Ghost vulnerable to XSS via malicious Portal preview links
High
CVE-2026-22596
Ghost has SQL Injection in Members Activity Feed
Medium
CVE-2026-22595
Ghost has Staff Token permission bypass
High
CVE-2026-22594
Ghost has Staff 2FA bypass
High
CVE-2024-43409
Ghost's improper authentication allows access to member information and actions
Medium
CVE-2024-23724
Ghost has possible Cross-site Scripting issue
Medium
CVE-2024-23725
Cross-site Scripting in Ghost
Medium
CVE-2023-40028
Ghost vulnerable to arbitrary file read via symlinks in content import
Medium
CVE-2023-32235
Path Traversal in Ghost
High
CVE-2023-31133
Ghost vulnerable to information disclosure of private API fields
High
CVE-2022-41654
ghost vulnerable to unauthorized newsletter modification via improper access…
High
CVE-2022-27139
Arbitrary file upload in Ghost
Critical
CVE-2022-28397
Arbitrary file upload in Ghost
Critical
CVE-2021-39192
Privilege escalation: all users can access Admin-level API keys
Medium
CVE-2020-8134
Server-side request forgery in Ghost CMS
Medium
CVE-2021-29484
DOM XSS in Theme Preview
Medium

Prioritize ghost vulnerabilities

Kodem Kai can identify which of these CVEs are reachable in your dependency tree and generate targeted fix recommendations.

Get a demo →

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo