CVE-2026-105679
1 advisory.
npm/ghost CVE-2026-104411, CVE-2026-105679: high 7.3
Ghost: Stored XSS via File Uploads on Local Storage
Action: Upgrade ghost to 6.64.0 or later.
npm i ghost@6.64.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.22.1 | 6.64.0 | - |
Fixed versions
| 6.64.0 |
Sources
- osv: GHSA-gfjp-2p8f-94qv
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-gfjp-2p8f-94qv
- https://nvd.nist.gov/vuln/detail/CVE-2026-105679
- https://github.com/TryGhost/Ghost/pull/30762
- https://github.com/TryGhost/Ghost/commit/58669d5c8b898f8b69c1287c2779b29ecc7eb918
- https://github.com/TryGhost/Ghost
- https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
CVE-2026-104411, CVE-2026-105679 · published · modified · JSON