Ghost, a Node.js CMS, contains a stored XSS flaw between releases 5.94.0 and 6.63.x. When a staff user creates a bookmark card, Ghost downloads the requested bookmark icon or thumbnail, accepting any file type. Because the downloaded content is not validated or sanitized, any staff member, including Contributors, can embed arbitrary HTML into the record. When the bookmark is later viewed, that malicious code executes in the browser of any admin user viewing the card, potentially allowing an attacker to hijack that user’s admin session or perform further malicious actions. This weakness is represented by CWE‑79 and also involves improper file handling (CWE‑434).

The vulnerability affects Ghost installations from version 5.94.0 up to and including 6.63.x. These releases are vulnerable; the issue was fixed in Ghost 6.64.0. Users running any of the vulnerable releases should consider themselves at risk.

The CVSS score of 7.3 indicates moderate to high severity. EPSS data is not available, so the exact exploit probability cannot be quantified. The flaw is not listed in the CISA KEV catalog, but it can be exploited by any staff user with bookmark creation privileges. Because the malicious payload runs in the admin’s browser context, an attacker may hijack admin sessions or further compromise the site. Formal mitigation is provided in the official patch.