Skip to main content
HIGH

CVE-2026-105643

CVSS v3

7.3

HIGH

EPSS Score

—

exploit probability

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Description

Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, potentially compromising that user’s admin session. Self-hosted sites should leave the new  security.embedPreviewUrl  configuration option at its default value. This issue is fixed in ve

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Published
2026-10-05
Last Modified
2026-10-05

Frequently asked questions

What is CVE-2026-105643?

Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, potentially compromising that user’s admin session. Self-hosted sites should leave the new  security.embedPreviewUrl  configuration option at its default value. This issue is fixed in ve

Is CVE-2026-105643 actively exploited?

Active exploitation of CVE-2026-105643 has not been confirmed.

What is the CVSS score for CVE-2026-105643?

CVE-2026-105643 has a CVSS v3 base score of 7.3 (HIGH severity), with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N.

Is CVE-2026-105643 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEsSIEM & TIP integrations

No credit card required · 50 free checks/month · Free API key

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database