Ghost: Remote Code Execution via Bookmark Card Images

### Impact An image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. ### Vulnerable versions This vulnerability is present in Ghost from v6.56.0 up to v6.65.0. ### Patches v6.67.0 contains a fix for this issue. ### How to update For self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost). If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update). ### References We thank [Rafael B.](https://github.com/rafabd1) for disclosing this vulnerability responsibly. ### For more information If you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org). Source Code Location: https://github.com/TryGhost/Ghost Affected Packages: - npm:ghost, affected >= 6.56.0, < 6.67.0, patched in 6.67.0 CWEs: - CWE-94: Improper Control of Generation of Code ('Code Injection') - CWE-1395: Dependency on Vulnerable Third-Party Component CVSS: - Primary: score 8.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS_V3: score 8.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H References: - https://github.com/TryGhost/Ghost/security/advisories/GHSA-788w-68h3-cvxp - https://nvd.nist.gov/vuln/detail/CVE-2026-105642 - https://github.com/advisories/GHSA-788w-68h3-cvxp