High severity8.1NVD Advisory· Published Oct 1, 2026

CVE-2026-103277

Description

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially compromising administrative access.

Affected products

Ghostty/Ghosttyllm-fuzzy
Range: >=2.5.0 <6.34.0

Patches

Vulnerability mechanics

References

github.com/TryGhost/Ghost/security/advisories/GHSA-8vhf-xxpj-4qrgnvd
www.vulncheck.com/advisories/ghost-2.5.0-before-6.34.0-untrusted-script-execution-via-oembednvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000