{"id":"EUVD-2026-92636","enisaUuid":"9c6e61b1-3ecc-3535-8984-60192abc4527","description":"Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.","datePublished":"Oct 5, 2026, 6:58:26 PM","dateUpdated":"Oct 7, 2026, 9:41:48 PM","baseScore":4.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-fwh9-qg68-vxp4\nhttps://github.com/TryGhost/Ghost/pull/31058\nhttps://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.66.0\n","aliases":"CVE-2026-105646\nGHSA-fwh9-qg68-vxp4\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"b76b6346-adaa-3c71-9d63-9347161970ac","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"4.0.0, \u003c 6.67.0"}],"enisaIdVendor":[{"id":"1ac147a7-9ed6-3b33-a056-8ce38d0db959","vendor":{"name":"TryGhost"}}],"enisaIdVulnerability":[{"id":"2990d9af-5d1b-3292-b346-38a115d364e9","vulnerability":{"id":"GHSA-fwh9-qg68-vxp4","description":"Ghost: Regular Expression Denial of Service in Content Import","datePublished":"Oct 7, 2026, 8:42:53 PM","dateUpdated":"Oct 7, 2026, 8:42:53 PM","baseScore":0.0,"references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-fwh9-qg68-vxp4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105646\nhttps://github.com/TryGhost/Ghost/pull/31058\nhttps://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce\nhttps://github.com/TryGhost/Ghost\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.66.0\n","enisa_id":"EUVD-2026-92636\n","aliases":"GHSA-fwh9-qg68-vxp4\nCVE-2026-105646\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"5037c03b-9f4f-371e-b85a-fa9d2d0e12df","vulnerability":{"id":"CVE-2026-105646","description":"Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.","datePublished":"Oct 5, 2026, 6:58:26 PM","dateUpdated":"Oct 7, 2026, 9:41:48 PM","status":"PUBLISHED","baseScore":4.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-fwh9-qg68-vxp4\nhttps://github.com/TryGhost/Ghost/pull/31058\nhttps://github.com/TryGhost/Ghost/commit/88ae6d6d56f8a239cb38a8c89de02f034f50e2ce\nhttps://github.com/TryGhost/Ghost/releases/tag/v6.66.0\n","enisa_id":"EUVD-2026-92636\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Oct 27, 2026, 7:16:28 AM","vulnerabilityProduct":[{"id":"6c1d6c8a-43b4-353e-ae3d-3e7690884323","product":{"name":"Ghost","vendor":{"name":"TryGhost"}},"product_version":"4.0.0, \u003c 6.67.0"}],"vulnerabilityVendor":[{"id":"1349dee1-9e73-30fe-952d-f98d6e014a28","vendor":{"name":"TryGhost"}}]}}],"enisaIdAdvisory":[]}