{"action":"Upgrade ghost to 5.130.4 or later.","affected":[{"fixed":"6.0.9","introduced":"6.0.0"},{"fixed":"5.130.4","introduced":"5.99.0"}],"component":"ghost","cve_ids":["CVE-2025-9862"],"ecosystem":"npm","epss":0.00517,"exploited":false,"fixed_versions":["6.0.9","5.130.4"],"ghsa_id":"GHSA-f7qg-xj45-w956","id":"tcs_01M5KFMWS39471JS5D11MSWPJ8","modified_at":"2026-01-29T21:26:14.741276Z","published_at":"2025-09-15T20:31:14Z","references":["https://osv.dev/vulnerability/GHSA-f7qg-xj45-w956","https://github.com/TryGhost/Ghost/security/advisories/GHSA-f7qg-xj45-w956","https://nvd.nist.gov/vuln/detail/CVE-2025-9862","https://github.com/TryGhost/Ghost/commit/01d64c7c0ffbf90cd036195c60ded6d08077d612","https://github.com/TryGhost/Ghost/commit/ffe9d079afa68557c581d224f1ff126e625b06e3","https://fluidattacks.com/advisories/regida","https://github.com/TryGhost/Ghost","https://github.com/TryGhost/Ghost/releases/tag/v6.0.9"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-f7qg-xj45-w956","url":"https://osv.dev/vulnerability/GHSA-f7qg-xj45-w956"}],"summary":"Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark"}