ghost 6.5.1 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the ghost package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Access Restriction Bypass ghost is a publishing platform Affected versions of this package are vulnerable to Access Restriction Bypass that allows contributors to view draft posts of other users via the `/ghost/api/admin/posts` endpoint and draft pages of other users via the `/ghost/api/admin/pages` endpoint. NOTE: The vendor's position is that this behavior has no security impact. How to fix Access Restriction Bypass? There is no fixed version for `ghost`.	>=0.4.2-rc1
M Cross-site Scripting (XSS) ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the `codeinjection_foot` field, which allows users to inject JavaScript into posts. How to fix Cross-site Scripting (XSS)? There is no fixed version for `ghost`.	>=0.0.0
M Cross-site Scripting (XSS) ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the `codeinjection_head` field, which allows users to inject JavaScript into posts. How to fix Cross-site Scripting (XSS)? There is no fixed version for `ghost`.	>=0.0.0
M Cross-site Scripting (XSS) ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the `facebook` field, which allows users to inject JavaScript into posts. How to fix Cross-site Scripting (XSS)? There is no fixed version for `ghost`.	>=0.0.0
M Cross-site Scripting (XSS) ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the `twitter` field, which allows users to inject JavaScript into posts. How to fix Cross-site Scripting (XSS)? There is no fixed version for `ghost`.	>=0.0.0

Vulnerability

Vulnerable Version

Access Restriction Bypass

ghost is a publishing platform

Affected versions of this package are vulnerable to Access Restriction Bypass that allows contributors to view draft posts of other users via the /ghost/api/admin/posts endpoint and draft pages of other users via the /ghost/api/admin/pages endpoint.

NOTE: The vendor's position is that this behavior has no security impact.

How to fix Access Restriction Bypass?