CVE-2026-105645

Summary

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.

Affected Software

Weaknesses

• CWE-1333: CWE-1333: Inefficient Regular Expression Complexity

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/TryGhost/Ghost/security/advisories/GHSA-9m4w-fmjw-fvjq
• https://github.com/TryGhost/Ghost/issues/31058
• https://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce
• https://github.com/TryGhost/Ghost/releases/tag/v6.66.0

• ←Previous
• Next→