{"id":"EUVD-2026-39019","enisaUuid":"204043e4-9672-3451-ae71-12b4098c3849","description":"@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.","datePublished":"Jun 24, 2026, 6:04:25 PM","dateUpdated":"Jun 24, 2026, 6:49:55 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-xpp7-93x6-v29m\n","aliases":"CVE-2026-53950\nGHSA-xpp7-93x6-v29m\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"73f5c99c-8b64-3bb0-845b-a2b1db115b52","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"\u003c 3.1.0"}],"enisaIdVendor":[{"id":"2205900f-06f6-38f9-8e8e-f7e8cc2ca01b","vendor":{"name":"TryGhost"}}],"enisaIdVulnerability":[{"id":"8bd885b0-ba09-367e-a0d3-0c721960beea","vulnerability":{"id":"GHSA-xpp7-93x6-v29m","description":"XSS in Ghost\u0027s ActivityPub client","datePublished":"Aug 4, 2026, 9:54:01 PM","dateUpdated":"Aug 4, 2026, 9:54:01 PM","baseScore":0.0,"references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-xpp7-93x6-v29m\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53950\nhttps://github.com/TryGhost/Ghost\n","enisa_id":"EUVD-2026-39019\n","aliases":"GHSA-xpp7-93x6-v29m\nCVE-2026-53950\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f895ac67-dc72-3f42-9941-8923b049e0b9","vulnerability":{"id":"CVE-2026-53950","description":"@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.","datePublished":"Jun 24, 2026, 6:04:25 PM","dateUpdated":"Jun 24, 2026, 6:49:55 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-xpp7-93x6-v29m\n","enisa_id":"EUVD-2026-39019\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 1, 2026, 7:17:30 AM","vulnerabilityProduct":[{"id":"3dbefa5d-d848-3f65-a72c-91669103759a","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"\u003c 3.1.0"}],"vulnerabilityVendor":[{"id":"db8b5c62-eac6-3ac6-bbf2-a0cc38ef9563","vendor":{"name":"TryGhost"}}]}}],"enisaIdAdvisory":[]}