CVE-2026-105645

Published: Oct 5, 2026Modified: Oct 6, 2026Deferred

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.2 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.

Related CWEs

CWE-1333

Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References (4)

https://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce

Source: security-advisories@github.com

https://github.com/TryGhost/Ghost/issues/31058

Source: security-advisories@github.com

https://github.com/TryGhost/Ghost/releases/tag/v6.66.0

Source: security-advisories@github.com

https://github.com/TryGhost/Ghost/security/advisories/GHSA-9m4w-fmjw-fvjq

Source: security-advisories@github.com

Timeline

No history available yet.