CVE-2026-70588

Severity CVSS v4.0:

Pending analysis

Type:

CWE-79 Cross-Site Scripting (XSS)

Publication date:

04/08/2026

Last modified:

05/08/2026

Description

Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L CVSS v3.1 Severity and Metrics:

Base Score: 5.00 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L

Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): High
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): High
Availability (A): Low

Base Score 3.x

5.00

Severity 3.x

MEDIUM

References to Advisories, Solutions, and Tools

https://github.com/TryGhost/Ghost/commit/a8bea3a4ceec4c852b880f4885119453c3d8588e
https://github.com/TryGhost/Ghost/pull/29635
https://github.com/TryGhost/Ghost/releases/tag/v6.54.1
https://github.com/TryGhost/Ghost/security/advisories/GHSA-2gx6-7gx2-wwcf