CVE-2026-103277: Tryghost Ghost

High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially compromising administrative access.

Affected products

• Tryghost Ghost: from 2.5.0, before 6.34.0 (fixed in 6.34.0)

Published 2026-10-01. Last modified 2026-10-01.