Ghost, a Node.js Content Management System, contains a vulnerability that allows attackers to execute arbitrary code on the server by deploying specially crafted malicious themes. The flaw is a form of improper input handling, aligning with CWE-74. When a theme is installed, the CMS fails to validate the theme’s contents, enabling attackers to run code with the privileges of the Ghost process.

This issue affects Ghost versions from 0.7.2 through 6.19.0, inclusive. The vendor responsible for this product is TryGhost, and the component is the Ghost CMS running on Node.js. The vulnerability was patched in Ghost version 6.19.1 and later releases.

The CVSS score of 7.7 indicates a high severity level, while an EPSS score of less than 1% indicates a low probability of exploitation at the time of this analysis. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that attackers who can upload or install a theme to an affected Ghost instance – for example by using the administrative interface or by directly placing theme files – may leverage the flaw to run arbitrary code on the host. The impact can be wide‑range, including full system compromise, data exfiltration, or lateral movement within the network.