Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-62q6-4hv4-vjrw, is a cache-poisoning cross-site scripting (XSS) issue in Ghost's frontend. It occurs when a shared caching layer is used. An unauthenticated attacker can send a specially crafted x-ghost-preview header, which alters the rendered frontend response. If the caching layer is not configured to ignore this header, the modified, potentially malicious, response can be cached and served to other users.
To identify the vulnerable functions, I analyzed the commits between the last vulnerable version (v6.36.0) and the first patched version (v6.37.0). The commit 84c4f3f099455f6f151ebfa2708ae69cfc9e0345 with the message "Added no-cache handling for preview requests" directly addresses the vulnerability.
The changes in this commit are in ghost/core/core/frontend/web/middleware/frontend-caching.js. The function setFrontendCacheHeadersMiddleware was modified to check for the x-ghost-preview header. If the header is present, it sets the Cache-Control header to no-cache, effectively preventing the response from being stored in any cache.
Therefore, the function setFrontendCacheHeadersMiddleware is the key function related to this vulnerability. Before the patch, its failure to account for the x-ghost-preview header made it the point of vulnerability. During exploitation, a profiler would show this middleware being executed as part of the request-response cycle for a frontend page.
setFrontendCacheHeadersMiddlewareghost/core/core/frontend/web/middleware/frontend-caching.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ghost | npm | >= 4.0.0, <= 6.36.0 | 6.37.0 |