CVE-2026-29053
Ghost Vulnerable to Remote Code Execution via Malicious Themes
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Ghost_CMS 6.19.0 - Remote Code Execution2026-09-02 · webapps · multiple
Impact
### Impact Specifically crafted malicious themes can execute arbitrary code on the server running Ghost. ### Vulnerable Versions This vulnerability is present in Ghost v0.7.2 to v6.19.0. ### Patches v6.19.1 contains a fix for this issue. ### Workarounds Ghost generally recommends users refrain from installing untrusted themes. If a malicious theme has already been installed, it is recommended to uninstall the theme and then inspect it to understand its impact, which will be attack-specific. ### References Ghost thanks Cristian-Alexandru Staicu at Endor Labs for disclosing this vulnerability responsibly. ### For more information If there are any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | ghost | >= 0.7.2, <= 6.19.0 | 6.19.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ghost | Ghost | from 0.7.2 before 6.19.1 |