CVE-2026-29053

Ghost Vulnerable to Remote Code Execution via Malicious Themes

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

Affected

TryGhost · Ghost

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 GITHUB

7.6 HIGHCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

EPSS

4.99% chance of exploitation in the next 30 days, 92nd percentile

Published

2026-03-05

Proof-of-concept exploits (2)

• rootxran/CVE-2026-290531★ · 2026-03-12
• AC8999/CVE-2026-290531★ · 2026-04-21

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/ghostcms_auth_rce_cve…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52676

Security advisories

• TryGhost/Ghost/security/advisories/GHSA-cgc2-rcrh-qr5x
• advisories/GHSA-cgc2-rcrh-qr5x

References

• CVE Record
• NVD entry

Related

• CVE-2009-3999
• CVE-2018-9276
• CVE-2024-40453
• CVE-2025-24071
• CVE-2025-27636
• CVE-2025-32463