CVE-2026-53950

Summary

XSS in Ghost's ActivityPub client

Severity

high

CVSS

7.5

EPSS

0.4% (p29)

CWE

CWE-79

Also known as

GHSA-xpp7-93x6-v29m

Published

2026-08-04

Updated

2026-08-04

Advisory details

Impact

The ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server.

Vulnerable Versions

This vulnerability is present in the @tryghost/activitypub package up to v3.0.8. All prior versions are also affected.

Patches

@tryghost/activitypub v3.1.0 contains a fix for this issue and is also automatically fetched by Ghost.

References

Ghost thanks Brad Geesaman, Ghost Security for disclosing this vulnerability responsibly.

For more information

If you have any questions or comments about this advisory, email Ghost at security@ghost.org.

References

• https://github.com/advisories/GHSA-xpp7-93x6-v29m
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-xpp7-93x6-v29m
• https://nvd.nist.gov/vuln/detail/CVE-2026-53950

Related advisories

• GHSA-cg2g-xh64-v4q7 — critical · npm/dompurify
• CVE-2026-102989 — critical · npm/@tanstack/start-server-core
• CVE-2026-104252 — critical · Go/vitess.io/vitess
• CVE-2026-107845 — critical · Packagist/contao/comments-bundle
• CVE-2026-106102 — critical · npm/quasar
• CVE-2026-10032 — critical · npm/@a2ui/web_core
• CVE-2026-59167 — critical · npm/suneditor
• CVE-2026-75828 — critical · Packagist/getgrav/grav

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity