7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29053

CVE-2026-29053: Ghost Vulnerable to Remote Code Execution via Malicious Themes

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29053

CVE-2026-29053:

7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ghost	npm	>= 0.7.2, <= 6.19.0	6.19.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the use of the jsonpath library, which is susceptible to remote code execution through the evaluation of malicious expressions. The primary attack vector is through Ghost themes, which can use the {{#get}} helper. This helper, in turn, used the vulnerable jsonpath.query function to resolve data paths provided in the theme templates.

The patch replaces the usage of jsonpath.query with a custom, safe implementation called querySimplePath within the get helper's logic. This new function only supports a limited, safe subset of path expressions and does not perform any evaluation, thus eliminating the RCE vulnerability.

A secondary fix was also applied by bumping the @tryghost/api-framework package. This update also removed a dependency on jsonpath within an input validator in the API framework, suggesting a broader effort to remove the vulnerable library from the codebase and hardening against other potential, though less direct, attack vectors.

Vulnerable functions

get

ghost/core/core/frontend/helpers/get.js

The `get` helper, used in Ghost themes, utilized the `jsonpath` library to parse and resolve data paths. A vulnerability in the `jsonpath` library allowed for the evaluation of malicious expressions, leading to remote code execution. An attacker could craft a malicious theme with a specially designed path in a template, which would be processed by the `get` helper and passed to the vulnerable `jsonpath` function, resulting in code execution on the server.

querySimplePath

ghost/core/core/frontend/helpers/get.js

This function was introduced as a mitigation. It is a safer, custom implementation that replaces the vulnerable `jsonpath.query` function. It is not vulnerable itself, but it is a key part of the patch and indicates where the vulnerability was.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.