CVE-2026-70588

{
  "id": "CVE-2026-70588",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-04T21:16:38.750",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1."
    },
    {
      "lang": "es",
      "value": "Ghost es un sistema de gestión de contenido basado en Node.js. Desde la versión 5.26.0 hasta la 6.54.1, la función de Importación Universal en Ghost Admin no logró sanear correctamente el contenido importado, lo que resultó en XSS en el contenido de las publicaciones. Este problema está solucionado en la versión 6.54.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "TryGhost",
          "product": "Ghost",
          "versions": [
            {
              "version": ">= 5.26.0, < 6.54.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T17:56:35.355517Z",
          "id": "CVE-2026-70588",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/TryGhost/Ghost/commit/a8bea3a4ceec4c852b880f4885119453c3d8588e",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TryGhost/Ghost/pull/29635",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TryGhost/Ghost/releases/tag/v6.54.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-2gx6-7gx2-wwcf",
      "source": "[email protected]"
    }
  ]
}