{"id":"EUVD-2026-92635","enisaUuid":"a536a38e-e8a1-3c66-a78f-5863c6d45152","description":"Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.","datePublished":"Oct 5, 2026, 6:56:02 PM","dateUpdated":"Oct 5, 2026, 7:08:46 PM","baseScore":4.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-9m4w-fmjw-fvjq\nhttps://github.com/TryGhost/Ghost/issues/31058\nhttps://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.66.0\n","aliases":"CVE-2026-105645\nGHSA-9m4w-fmjw-fvjq\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"fd251670-147c-3fe3-9dc5-d9cfb738e547","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"5.37.0, \u003c 6.67.0"}],"enisaIdVendor":[{"id":"d6ad1460-6691-3625-ac03-c46498f80990","vendor":{"name":"TryGhost"}}],"enisaIdVulnerability":[{"id":"518c23f5-d43f-337c-a28e-a33f0afd237f","vulnerability":{"id":"GHSA-9m4w-fmjw-fvjq","description":"Ghost: Regular Expression Denial of Service in External Media Inliner","datePublished":"Oct 7, 2026, 8:43:00 PM","dateUpdated":"Oct 7, 2026, 8:43:00 PM","baseScore":0.0,"references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-9m4w-fmjw-fvjq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105645\nhttps://github.com/TryGhost/Ghost/issues/31058\nhttps://github.com/TryGhost/Ghost/pull/31058\nhttps://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce\nhttps://github.com/TryGhost/Ghost\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.66.0\n","enisa_id":"EUVD-2026-92635\n","aliases":"CVE-2026-105645\nGHSA-9m4w-fmjw-fvjq\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"67e550ff-37d5-3d45-a9cd-ec8b302a392f","vulnerability":{"id":"CVE-2026-105645","description":"Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.","datePublished":"Oct 5, 2026, 6:56:02 PM","dateUpdated":"Oct 5, 2026, 7:08:46 PM","status":"PUBLISHED","baseScore":4.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-9m4w-fmjw-fvjq\nhttps://github.com/TryGhost/Ghost/issues/31058\nhttps://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.66.0\n","enisa_id":"EUVD-2026-92635\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Oct 27, 2026, 7:16:28 AM","vulnerabilityProduct":[{"id":"3141af9c-db9c-3cb6-9b94-ca42a1aae8b1","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"5.37.0, \u003c 6.67.0"}],"vulnerabilityVendor":[{"id":"bb51b3f8-af30-3a2a-a986-a5676f98c151","vendor":{"name":"TryGhost"}}]}}],"enisaIdAdvisory":[]}