logo

Database

Server side cross-site scripting In ghost

Description

Cross-site Scripting in Ghost Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2024-237252. NVD-2024-237253. OSV-2024-237254. GCVE-2024-23725

References

1. https://github.com/TryGhost/Ghost/pull/171902. https://github.com/yunaycompany/Ghost/commit/64d67717f7c76c77b3908e15627f473e9ef340023. https://github.com/TryGhost/Ghost/releases/tag/v5.76.0

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.