CVE-2026-29053
published 2026-03-05CVE-2026-29053: Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.37%
29.0th percentile
Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ghost | ghost | >= 0.7.2 < 6.19.1 | 6.19.1 |
| ghost | ghost | >= 0.7.2 < 6.19.1 | 6.19.1 |
| tryghost | ghost | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Ghost Vulnerable to Remote Code Execution via Malicious Themes
osv·2026-03-03
CVE-2026-29053 [HIGH] Ghost Vulnerable to Remote Code Execution via Malicious Themes
Ghost Vulnerable to Remote Code Execution via Malicious Themes
### Impact
Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.
### Vulnerable Versions
This vulnerability is present in Ghost v0.7.2 to v6.19.0.
### Patches
v6.19.1 contains a fix for this issue.
### Workarounds
Ghost generally recommends users refrain from installing untrusted themes. If a malicious theme has already been installed, it is recommended to uninstall the theme and then inspect it to understand its impact, which will be attack-specific.
### References
Ghost thanks Cristian-Alexandru Staicu at Endor Labs for disclosing this vulnerability responsibly.
### For more information
If there are any questions or comments about this advisory, email Ghost at [security@ghost
GHSA
Ghost Vulnerable to Remote Code Execution via Malicious Themes
ghsa·2026-03-03
CVE-2026-29053 [HIGH] CWE-74 Ghost Vulnerable to Remote Code Execution via Malicious Themes
Ghost Vulnerable to Remote Code Execution via Malicious Themes
### Impact
Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.
### Vulnerable Versions
This vulnerability is present in Ghost v0.7.2 to v6.19.0.
### Patches
v6.19.1 contains a fix for this issue.
### Workarounds
Ghost generally recommends users refrain from installing untrusted themes. If a malicious theme has already been installed, it is recommended to uninstall the theme and then inspect it to understand its impact, which will be attack-specific.
### References
Ghost thanks Cristian-Alexandru Staicu at Endor Labs for disclosing this vulnerability responsibly.
### For more information
If there are any questions or comments about this advisory, email Ghost at [security@ghost
No detection rules found.
No public exploits indexed.
2026-03-05
Published