Ghost Admin Universal Import Vulnerability: Cross-Site Scripting Risk
- Severity
- HIGH
- Affected component
- ghost (npm)
- Affected versions
- >= 5.26.0, < 6.54.1 or >= 4.22.0, < 6.54.1 or >= 6.0.0, < 6.11.0 or >= 5.105.0, < 5.130.6 or >= 4.0.0, < 6.37.0 or >= 3.18.0, < 3.42.6 or >= 4.0.0, < 4.15.1 or >= 4.46.0, < 5.89.5 or >= 2.2.0, < 6.54.1 or < 4.48.2 or >= 5.0.0, < 5.2.3 or >= 6.19.4, < 6.21.1 or <= 5.76.0 or < 5.59.1 or >= 4.0.0, < 4.3.3 or >= 5.0.0, < 5.22.7 or >= 4.46.0, < 4.48.8 or >= 5.101.6, < 6.19.3 or >= 6.0.0, < 6.11.0 or >= 5.105.0, < 5.130.6 or >= 0.7.2, < 6.19.1 or >= 6.0.9, < 6.21.2 or >= 5.18.0, < 6.21.2 or >= 1.20.1, < 6.54.1 or >= 0.10.0, < 6.54.1 or >= 6.0.0, < 6.0.9 or >= 5.99.0, < 5.130.4 or <= 4.42.0 or < 5.76.0 or <= 4.39.0 or >= 6.19.4, < 6.21.2 or >= 0.10.0, < 6.54.1 or >= 6.0.0, < 6.11.0 or >= 5.105.0, < 5.130.6 or >= 5.43.0, < 5.121.0 or >= 6.0.0, < 6.15.0 or >= 4.0.0, < 4.10.0 or < 6.54.1 or >= 5.46.1, < 6.21.2 or >= 4.9.0, < 6.54.1 or < 3.10.0 or < 5.46.1 or >= 6.0.0, < 6.11.0 or >= 5.105.0, < 5.130.6 or >= 3.24.0, < 6.19.1 or < 5.42.1 or < 4.15.0 or >= 6.0.9, < 6.21.1 or >= 6.26.0, < 6.54.1 or >= 6.27.0, < 6.44.0
- Patched version
- v6.54.1
An early warning has been issued for a potential cross-site scripting vulnerability in the Universal Import feature of Ghost Admin. Versions from v5.26.0 up to v6.54.0 are reportedly affected.
What happened
The Universal Import feature in Ghost Admin failed to properly sanitize imported content, which could result in cross-site scripting (XSS) in post content. This vulnerability affects versions from v5.26.0 up to v6.54.0. The issue was first flagged on 2026-08-04T21:03:51+00:00 and is under investigation.
The affected versions include a complex range of releases, as detailed in the threat data. Users of these versions are advised to assess their exposure and take appropriate action to mitigate the risk.
What to do about it
- Upgrade to Ghost v6.54.1 to mitigate the vulnerability.
- Avoid using the Universal Import feature until the issue is resolved.
- Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.
How 0Day would have caught this
ghost is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Ghost versions from v5.26.0 up to v6.54.0.
What should I do right now?
Upgrade to Ghost v6.54.1 or avoid using the Universal Import feature.
Is there an official fix available?
Yes, the patched version is Ghost v6.54.1.