Medium
Ghost: Cross-Site Scripting in Universal Import
Type: advisorySources: OSV
Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-70588
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 18:40 UTC · Revision 1
Source evidence
Ghost: Cross-Site Scripting in Universal Import
core-osv · Original sourcePublished 4 Aug 2026, 21:03 UTC
Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1.
osv:CVE-2026-70588
Complete source record
{
"id": "616b0d888578600b288a57fe51e95181f3a0848b22d9ae3d0869619c52acf168",
"url": "https://osv.dev/vulnerability/CVE-2026-70588",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Ghost: Cross-Site Scripting in Universal Import",
"summary": "Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1.",
"evidence": "osv:CVE-2026-70588",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-70588",
"aliases": [
"BIT-ghost-2026-70588",
"CVE-2026-70588",
"GHSA-2gx6-7gx2-wwcf"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/tryghost/ghost",
"type": "GIT",
"events": [
{
"introduced": "26be3b9ccd1002de6d0a0de885bc8198c2d4389d"
},
{
"fixed": "94e25d9de158bc10b6a74d9aad75944b1a68ee13"
},
{
"fixed": "a8bea3a4ceec4c852b880f4885119453c3d8588e"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "5.26.0"
},
{
"fixed": "6.54.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "a8bea3a4ceec4c852b880f4885119453c3d8588e"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "94e25d9de158bc10b6a74d9aad75944b1a68ee13"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v6.54.1"
}
]
}
}
],
"versions": [
"v6.54.0",
"v6.53.0",
"v6.52.1",
"v6.52.0",
"v6.51.0",
"v6.50.0",
"v6.49.0",
"v6.48.0",
"v6.47.0",
"v6.46.0",
"v6.45.0",
"v6.44.1",
"v6.44.0",
"v6.43.1",
"v6.43.0",
"v6.42.0",
"v6.41.1",
"v6.41.0",
"v6.40.0",
"v6.39.0",
"v6.38.0",
"v6.37.1",
"v6.37.0",
"v6.36.0",
"v6.35.0",
"v6.34.0",
"v6.33.0",
"v6.32.0",
"v6.31.0",
"v6.30.0",
"v6.29.1",
"v6.29.0",
"v6.28.0",
"v6.27.0",
"v6.26.0",
"v6.25.1",
"v6.25.0",
"v6.24.0",
"v6.23.0",
"v6.22.1",
"v6.22.0",
"v6.21.0",
"v6.21.2",
"v6.21.1",
"v6.20.1",
"v6.20.0",
"v6.19.4",
"v6.19.3",
"v6.19.2",
"v6.19.0",
"v6.19.1",
"v6.18.2",
"v6.18.0",
"v6.17.1",
"v6.17.0",
"v6.16.1",
"v6.16.0",
"v6.15.0",
"v6.14.0",
"v6.13.2",
"v6.13.1",
"v6.13.0",
"v6.12.0",
"v6.11.0",
"v6.10.3",
"v6.10.0",
"v6.9.3",
"v6.9.2",
"v6.9.0",
"v6.8.1",
"v6.8.0",
"v6.7.0",
"v6.6.0",
"v6.5.3",
"v6.5.2",
"v6.5.0",
"v6.4.0",
"v6.3.1",
"v6.2.0",
"v6.3.0",
"v6.1.0",
"v6.0.10",
"v6.0.8",
"v6.0.7",
"v6.0.6",
"v6.0.5",
"v6.0.4",
"v6.0.3",
"v6.0.1",
"v6.0.0",
"v6.0.0-rc.3",
"v6.0.0-rc.2",
"v6.0.0-rc.1",
"v6.0.0-rc.0",
"v6.0.0-alpha.2",
"v5.130.1",
"v5.130.0",
"v5.129.2",
"v5.129.1",
"v5.129.0",
"v5.128.0",
"v5.127.1",
"v5.127.0",
"v5.126.0",
"v5.125.1",
"v5.122.0",
"v5.121.0",
"v5.120.2",
"v5.120.0",
"v5.119.2",
"v5.119.0",
"v5.118.1",
"v5.118.0",
"v5.117.0",
"v5.116.2",
"v5.116.0",
"v5.115.1",
"v5.114.0",
"v5.113.0",
"v5.112.0",
"v5.111.0",
"v5.110.2",
"v5.110.0",
"v5.109.6",
"v5.109.3",
"v5.109.0",
"v5.108.1",
"v5.108.0",
"v5.107.0",
"v5.106.1",
"v5.106.0",
"v5.105.0",
"v5.104.0",
"v5.103.0",
"v5.102.0",
"v5.101.6",
"v5.101.4",
"v5.101.0",
"v5.99.0",
"v5.100.0",
"v5.98.0",
"v5.97.0",
"v5.96.1",
"v5.96.0",
"v5.95.0",
"v5.94.2",
"v5.94.1",
"v5.94.0",
"v5.93.0",
"v5.92.0",
"v5.91.0",
"v5.90.0",
"v5.89.2",
"v5.89.1",
"v5.89.0",
"v5.88.2",
"v5.88.1",
"v5.88.0",
"v5.87.2",
"v5.87.1",
"v5.87.0",
"v5.86.2",
"v5.86.1",
"v5.86.0",
"v5.85.1",
"v5.85.0",
"v5.84.2",
"v5.84.1",
"v5.84.0",
"v5.83.0",
"v5.82.12",
"v5.82.11",
"v5.82.9",
"v5.82.6",
"v5.82.4",
"v5.82.3",
"v5.82.2",
"v5.82.1",
"v5.82.0",
"v5.81.1",
"v5.81.0",
"v5.80.4",
"v5.80.3",
"v5.80.2",
"v5.80.0",
"v5.79.5",
"v5.79.3",
"v5.79.2",
"v5.79.1",
"v5.79.0",
"v5.78.0",
"v5.77.0",
"v5.76.0",
"@tryghost/portal@2.37.0",
"@tryghost/portal@2.36.5",
"v5.75.0",
"v5.74.4",
"v5.74.0",
"v5.73.1",
"v5.73.0",
"v5.72.0",
"v5.71.0",
"v5.70.1",
"v5.70.0",
"v5.69.1",
"v5.69.0",
"v5.68.0",
"v5.67.1",
"v5.67.0",
"v5.66.0",
"v5.65.0",
"v5.63.0",
"v5.62.0",
"v5.61.0",
"v5.60.0",
"@tryghost/comments-ui@0.13.0",
"v5.59.2",
"v5.59.0",
"v5.58.0",
"v5.57.0",
"v5.56.0",
"v5.55.0",
"v5.54.2",
"v5.54.1",
"v5.54.0",
"v5.53.3",
"v5.53.1",
"@tryghost/announcement-bar@1.1.7",
"@tryghost/portal@2.33.4",
"@tryghost/portal@2.33.3",
"v5.53.0",
"@tryghost/announcement-bar@1.1.6",
"@tryghost/signup-form@0.1.3",
"v5.52.0",
"@tryghost/admin-x-settings@0.0.8",
"@tryghost/signup-form@0.1.2",
"@tryghost/portal@2.33.2",
"@tryghost/admin-x-settings@0.0.7",
"@tryghost/signup-form@0.1.1",
"v5.51.0",
"@tryghost/signup-form@0.1.0",
"@tryghost/signup-form@0.0.3",
"@tryghost/portal@2.33.1",
"v5.49.3",
"@tryghost/portal@2.33.0",
"v5.49.1",
"@tryghost/signup-form@0.0.1",
"@tryghost/admin-x-settings@0.0.6",
"@tryghost/portal@2.32.0",
"@tryghost/portal@2.31.2",
"v5.48.0",
"@tryghost/admin-x-settings@0.0.5",
"@tryghost/admin-x-settings@0.0.4",
"@tryghost/admin-x-settings@0.0.3",
"@tryghost/admin-x-settings@0.0.2",
"v5.47.1",
"@tryghost/portal@2.31.1",
"@tryghost/portal@2.31.0",
"@tryghost/portal@2.30.1",
"v5.47.0",
"@tryghost/portal@2.30.0",
"v5.46.0",
"v5.45.1",
"v5.45.0",
"v5.44.0",
"@tryghost/portal@2.29.3",
"@tryghost/portal@2.29.2",
"v5.43.0",
"@tryghost/portal@2.29.1",
"@tryghost/portal@2.29.0",
"v5.42.2",
"@tryghost/portal@2.28.1",
"v5.42.0",
"@tryghost/portal@2.28.0",
"@tryghost/portal@2.27.0",
"v5.41.0",
"@tryghost/portal@2.26.0",
"v5.40.1",
"v5.40.0",
"v5.39.0",
"v5.38.0",
"v5.37.0",
"v5.36.0",
"v5.35.0",
"@tryghost/portal@2.25.0",
"v5.34.0",
"v5.33.0",
"v5.31.0",
"v5.30.1",
"v5.30.0",
"v5.28.0",
"@tryghost/portal@2.24.1",
"@tryghost/portal@2.24.0",
"v5.27.0",
"@tryghost/portal@2.23.0",
"v5.26.4",
"v5.26.3",
"v5.26.2",
"v5.26.1",
"v5.26.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70588.json"
}
}
],
"modified": "2026-10-28T02:30:38.225079461Z",
"provider": "osv",
"references": [
"https://github.com/TryGhost/Ghost/releases/tag/v6.54.1",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70588.json",
"https://github.com/TryGhost/Ghost/security/advisories/GHSA-2gx6-7gx2-wwcf",
"https://nvd.nist.gov/vuln/detail/CVE-2026-70588",
"https://github.com/TryGhost/Ghost/commit/a8bea3a4ceec4c852b880f4885119453c3d8588e",
"https://github.com/TryGhost/Ghost/pull/29635"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70588.json"
}
},
"related_cves": [
{
"value": "CVE-2026-70588",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505786,
"published_at": "2026-08-04T21:03:42.379+00:00"
}