CVE-2026-29784 is a high-severity (CVSS 7.5) Cross-Site Request Forgery (CSRF) vulnerability in ghost. A fix is available for ghost — see the affected versions and patch details below.
Ghost: Incomplete CSRF protections around OTC use
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-29784.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
ghostnpmDescription
Impact
Incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost site.
Vulnerable versions
This vulnerability is present in Ghost from v5.101.6 up to v6.19.2.
Patches
v6.19.3 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If a project's Ghost is a Ghost-CLI install see the documentation on updating it to the latest version here.
For more information
If there are any questions or comments about this advisory, send an email to [email protected].
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | ghost | ≥ 5.101.6&&< 6.19.3 | 6.19.3npm install ghost@6.19.3 |
Affected Products
ghostghostDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ghost, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update ghost to 6.19.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-29784 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is CVE-2026-29784 in your dependencies?
Find it across npm, including transitive dependencies.