← All advisories

High severity8.8NVD Advisory· Published May 22, 2024· Updated Jun 17, 2026

CVE-2024-34448

CVE-2024-34448

Description

Ghost before 5.82.0 allows CSV Injection during a member CSV export.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@tryghost/members-csvnpm	< 5.82.0	5.82.0

Affected products

4

Tryghost/Ghost2 versions
cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*range: <5.82.0
- (no CPE)
osv-coords2 versions
pkg:bitnami/ghost pkg:npm/%40tryghost/members-csv
< 5.82.0+ 1 more
- (no CPE)range: < 5.82.0
- (no CPE)range: < 5.82.0

Patches

Vulnerability mechanics

References

4

github.com/phulelouch/CVEs/blob/main/CVE-2024-34448.mdnvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-xgwh-cgv9-783vghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-34448ghsaADVISORY
github.com/TryGhost/Ghost/commit/de668e7950a019a204b2df0c84596ea0fa32cce6ghsaWEB

News mentions

0

No linked articles in our index yet.