CVE-2026-70588: Ghost CMS XSS Vulnerability

CVE-2026-70588 Overview

CVE-2026-70588 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in Ghost, a Node.js content management system. The Universal Import feature in Ghost Admin fails to properly sanitize imported content, allowing malicious scripts to persist in post content. The flaw affects Ghost versions from 5.26.0 through 6.54.0 and is resolved in version 6.54.1. Exploitation requires high privileges and complex conditions but can compromise post integrity and expose administrative sessions to script execution.

Critical Impact
Authenticated attackers with import privileges can inject persistent JavaScript into Ghost posts, enabling session theft, content manipulation, and administrative action hijacking against users viewing affected content.

Affected Products

Ghost CMS versions 5.26.0 through 6.54.0
Ghost Admin Universal Import feature
Ghost self-hosted and managed deployments prior to 6.54.1

Discovery Timeline

2026-08-04 - CVE-2026-70588 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70588

Vulnerability Analysis

The vulnerability resides in Ghost's Universal Import feature within Ghost Admin. The feature accepts imported content but does not enforce output sanitization before rendering that content in post views. Malicious HTML and JavaScript embedded in imported files persist in the database and execute in the browser context of any user viewing the affected post.

Because the executed script runs within the Ghost Admin origin, it inherits the privileges of the current session. This creates a stored XSS condition where the payload is delivered once during import and triggered repeatedly during content rendering.

Root Cause

The root cause is missing HTML sanitization in two components: the modal-post-history.js component within apps/ember-admin/app/components/ and the frontend proxy service at ghost/core/core/frontend/services/proxy.js. Neither location applied DOMPurify filtering to content originating from the Universal Import pipeline, allowing script-bearing markup to reach the DOM intact.

Attack Vector

An attacker with authenticated access to Ghost Admin and permission to use the Universal Import feature crafts an import payload containing embedded scripts. Once imported, the payload is stored as post content. When an administrator or editor previews the post history or renders the content through affected frontend proxy paths, the script executes with the viewer's session context.

javascript

// Security patch in apps/ember-admin/app/components/modal-post-history.js
 import Component from '@glimmer/component';
+import DOMPurify from 'dompurify';
 import RestoreRevisionModal from '../components/modals/restore-revision';
 import {action, set} from '@ember/object';
 import {inject as service} from '@ember/service';

// Security patch in ghost/core/core/frontend/services/proxy.js
 const {SafeString} = require('./handlebars');

+const createDOMPurify = require('dompurify');
+const {JSDOM} = require('jsdom');
+const DOMPurify = createDOMPurify(new JSDOM('').window);

The patch introduces DOMPurify to sanitize imported and rendered content in both the Ember admin component and the server-side frontend proxy. Source: GitHub Commit a8bea3a

Detection Methods for CVE-2026-70588

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (onerror, onload) in stored Ghost post content or revision history
Universal Import operations performed by accounts that do not typically author content
Outbound HTTP requests from admin browser sessions to unknown domains following post history views
Modified post revisions containing base64-encoded or obfuscated JavaScript payloads

Detection Strategies

Query the Ghost database posts and posts_meta tables for HTML tags and JavaScript event handlers introduced through imports
Review Ghost Admin audit logs for Universal Import actions correlated with subsequent unusual admin activity
Deploy Content Security Policy (CSP) reporting endpoints to capture script-src violations originating from Ghost Admin
Inspect network telemetry for anomalous requests from authenticated admin sessions to external hosts

Monitoring Recommendations

Enable web server access logging for /ghost/api/admin/db/ and import-related endpoints
Alert on Universal Import operations followed by admin session activity from new IP addresses
Monitor for changes to post content that introduce script tags or inline event handlers

How to Mitigate CVE-2026-70588

Immediate Actions Required

Upgrade Ghost to version 6.54.1 or later immediately
Audit recent Universal Import operations and inspect imported posts for injected scripts
Rotate Ghost Admin session credentials and API keys if imports from untrusted sources occurred
Restrict Universal Import privileges to a minimal set of trusted administrators

Patch Information

Ghost released version 6.54.1 containing the fix. The patch adds DOMPurify sanitization to both the admin post-history component and the frontend proxy service. Review the GitHub Security Advisory GHSA-2gx6-7gx2-wwcf, GitHub Release v6.54.1, and Pull Request #29635 for full remediation details.

Workarounds

Disable the Universal Import feature until upgrade is completed if configuration permits
Enforce a strict Content Security Policy on Ghost Admin to block inline script execution
Limit Ghost Admin accounts with import privileges and require multi-factor authentication
Review all posts imported through Universal Import since deploying version 5.26.0

bash

# Upgrade Ghost to patched version using Ghost-CLI
ghost update 6.54.1

# Verify installed version after upgrade
ghost --version

# Restart Ghost service
ghost restart