Ghost, a Node.js content management system, contains a flaw in its bundled image processing library that improperly handles SVG files. Staff users—including contributors—can create a bookmark card pointing to an attacker‑controlled website. When that card is rendered, the vulnerable SVG processing code executes arbitrary commands on the Ghost server, allowing the attacker to run code with the privileges of the Ghost instance. The weakness is reflected in the cited CWE identifiers for code injection and improper input sanitization.

The vulnerability affects Ghost versions 6.56.0 through 6.67.0 released by TryGhost. All instances running any version in that range are susceptible until the update to 6.67.0 or later is applied.

With a CVSS score of 8.8, this issue presents a high severity potential for compromise. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so the current exploitation probability is unknown. The likely attack vector requires a staff account to create a malicious bookmark card, meaning the threat is limited to compromised or legitimately authorized users, but the impact remains severe once execution occurs.