CVE-2026-53943: Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

Synopsis

Cache-poisoning cross-site scripting (XSS) is present in the Ghost Node.js content management system, affecting versions 4.0.0 through 6.36.x. An unauthenticated attacker can reach the vulnerability over the network by sending a crafted x-ghost-preview header that, when stored by a shared caching layer, injects malicious script content into pages served to subsequent visitors. Successful exploitation allows the attacker to read sensitive data, tamper with page content, and take over staff user accounts on installations where the Ghost frontend and admin panel share a domain. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Ghost frontend service over the network to deliver the malicious x-ghost-preview header.

• AuthenticationNot required

  No credentials are needed; the attack is reachable by any unauthenticated HTTP client.

• Victim interactionRequired

  A legitimate visitor (such as a staff user) must load the cache-poisoned page for the injected script to execute in their browser.

• Attack complexityDetail

  The exploit is reliable and condition-free once a shared caching layer is in place; no race conditions or special memory layout requirements apply.

Blast Radius

• Attacker reads session tokens and authentication cookies belonging to staff users who load the poisoned page.
• Attacker modifies rendered page content served to all visitors hitting the cached URL.
• Attacker executes arbitrary JavaScript in the browser context of affected users, enabling full account takeover of Ghost staff accounts on same-domain deployments.
• All three confidentiality, integrity, and availability dimensions are rated High with scope change, meaning impact can extend beyond the Ghost process itself to the broader browser session.