CyberRota Analysis
AI-GeneratedGhost versions from 0.5.3 to prior to 6.50.0 are vulnerable due to inadequate sanitization of data in the JSON-LD HTML tag, allowing authenticated users with limited privileges to inject unescaped content. This can result in the execution of malicious scripts on published pages, potentially compromising the admin sessions of staff users who view these pages. Organizations using affected Ghost versions should prioritize patching to mitigate the risk of session hijacking and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_head}} helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to compromise of a staff user's admin session when that user views the affected page.