CVE-2026-105642: Remote Code Execution in Ghost CMS via Unsafe SVG Processing during Metadata Scraping

Ghost CMS utilizes backend scraper components to enrich user-generated posts with interactive content. When an editor inserts a 'Bookmark' block into a post, the platform issues a server-side request to scrape the metadata of the target site. This process extracts Open Graph and Twitter Card tags, resolving image assets like icons and preview graphics to display on the card.

The underlying mechanism relies on backend dependencies that parse these image formats. In Ghost versions 6.56.0 through 6.66.0, the application handles Scalable Vector Graphics (SVG) without sufficient sandboxing or validation. Because SVG is an XML-based format, processing it without strict boundaries exposes the server to file system access, network requests, and OS-level shell command execution.

This vulnerability is tracked as CWE-94 (Improper Control of Generation of Code) and CWE-1395 (Dependency on Vulnerable Third-Party Component). The exposure is elevated because even restricted users, such as Contributors, can insert Bookmark blocks, initiating the backend image processing routine. The architecture of this vector is detailed below:

The root cause of CVE-2026-105642 lies in the unsafe processing of XML-based graphics within the server's backend image-processing pipeline. When rendering metadata previews, Ghost downloads the remote image into a memory buffer and processes it via rendering engines such as @tryghost/kg-default-nodes or related image helpers. Older versions of these libraries passed the SVG payload directly to underlying native libraries without adequate sanitization.

Because SVGs are XML documents, they support advanced features such as external entity resolution (XXE), nested scripts, and system-level rendering operations. If the SVG parser does not run in a highly restricted sandbox, or if it leverages native libraries with buffer overflows or command injection vulnerabilities, a specially crafted SVG file can execute arbitrary system commands in the host shell.

The attack vector bypasses standard authentication boundaries because the victim does not need to upload the image directly to the Media Library. The upload is simulated via a third-party server, allowing an unprivileged contributor or an external actor who successfully social-engineers an author to pass the input directly to the internal renderer.

The remediation effort in commit 4cb7e7956356a47e2c2c240588ef32ecd9fddeaa focuses on isolating preview generation and updating vulnerable packages. Ghost introduced a configuration parameter, embedPreviewUrl, designed to route embedding requests through a sandboxed engine isolated from the main application origin.

Additionally, dependencies within the @tryghost/koenig-lexical and @tryghost/kg-default-nodes modules were updated to secure versions that lock image-rendering engines and sanitize vector inputs prior to passing them to native parser utilities.

The structural changes are highlighted in the configuration and dependency definitions:

// Package lock update in 6.67.0 release commit
{
  "name": "ghost",
  "version": "6.67.0",
  "dependencies": {
    "@tryghost/koenig-lexical": "2.13.0",
    "@tryghost/kg-default-nodes": "1.4.1"
  }
}

// Conceptual representation of the sandboxing control implementation
const previewConfig = {
    // Previous unsafe processing resolved remote images directly in main process
    // The update routes previews through isolated rendering domains
    embedPreviewUrl: process.env.EMBED_PREVIEW_URL || 'https://sandbox.ghost.org/embed',
    sandboxOptions: {
        allowScripts: false,
        allowSameOrigin: false
    }
};

By forcing the rendering of remote metadata to occur within an isolated container or origin, any code executed during parsing is constrained and cannot access the core application's file system or database credentials.

An attacker must construct a sequence where the Ghost backend is forced to parse an external SVG payload. The exploit chain consists of the following technical steps:

1. The attacker deploys an HTTP server hosting a web page containing Open Graph meta tags pointing to a target SVG:

<meta property="og:image" content="http://attacker.com/payload.svg" />

2. The attacker crafts payload.svg. The SVG payload uses structural features designed to trigger memory corruption or spawn terminal sessions within the native rendering binary associated with Ghost's image pipeline.

3. An attacker logs in with a 'Contributor' account (or uses social engineering to target a staff member) and creates a draft post. Within the Koenig editor, the user adds a 'Bookmark' block and enters the URL of the attacker's server.

4. The Ghost backend initiates an HTTP GET request to retrieve the metadata. It parses the HTML, extracts the URL for payload.svg, and fetches the SVG raw buffer into memory.

5. The buffer is processed by the unsafe image component, triggering the embedded payload. The shell command executes under the privileges of the active Node.js server daemon.

The impact of successful exploitation is complete compromise of the underlying host operating system. Because the Ghost server process typically requires read and write access to the main database, configuration directories, and local media folders, the attacker obtains the same permissions.

An attacker can read connection strings from the config.production.json file, granting immediate access to database environments containing user credentials, email lists, and site configurations. Furthermore, the attacker can leverage host access to execute lateral movement across internal subnets or modify application source files to inject malicious JavaScript, targeting site visitors with drive-by downloads or credential harvesting operations.

The CVSS v3.1 score is evaluated at 8.8 (High), with high metrics for Confidentiality, Integrity, and Availability impact. Although user interaction is required (forcing a staff user to paste a URL), the low privilege requirement makes this an extremely dangerous vector inside multi-user publishing environments.

The definitive mitigation for CVE-2026-105642 is upgrading the Ghost instance to version 6.67.0 or later. This updates the primary dependencies and installs the safe image parsing routines.

For administrators who cannot immediately apply the patch, the following workarounds should be applied:

1. Restrict Outbound Server Traffic: Configure host-level firewall rules using tools such as iptables or cloud security groups to block outgoing HTTP/HTTPS connections from the Ghost application server to untrusted external networks. This prevents the scraper from retrieving metadata from external attacker-controlled hosts.

2. Author Privilege Auditing: Temporarily revoke draft privileges for untrusted or low-privileged staff members, such as Contributors, to prevent the unauthorized insertion of unsafe Bookmark cards.

3. WAF Rules: Implement Web Application Firewall (WAF) policies designed to inspect draft payload requests and block requests targeting external domains containing unrecognized or suspicious query parameters and file types.