CVE-2026-29053 is a high severity (CVSS 7.6) flaw in Ghost, the Node.js CMS, from version 0.7.2 through 6.19.0. A crafted malicious theme can execute arbitrary code on the server. The fix is Ghost 6.19.1, and the project advises installing only trusted themes.
What's affected
The GitHub advisory lists the npm package ghost from 0.7.2 through 6.19.0 as affected, and 6.19.1 as the patched version.
The CVSS vector in the record shows that high privileges are required and user interaction is needed, which fits the route of an administrator installing a theme.
How to check if you're exposed
Check your Ghost version:
ghost version
For Docker, read the image tag. Then list the themes installed on the site, including the folder content/themes, and note where each came from.
What to do now
- Upgrade Ghost to 6.19.1 or later.
- Install themes only from sources you trust, and review third-party or custom themes before activating them.
- If you installed a theme from an unknown source, uninstall it and inspect it, as the advisory recommends. The impact depends on what the theme does.
- Limit who has administrator or theme upload rights, and use multi-factor authentication for them.
- Run Ghost as an unprivileged user so that code injected through a theme has limited reach.
Why it matters
The record classes the flaw as CWE-74, an injection weakness. The advisory says little about the mechanism, so I will not guess at it. What it does say is that a specially crafted theme can run code on the server, which means a theme package must be treated as code and not as design assets.
Themes bring templates and scripts. Anyone who can upload one, or any compromised theme marketplace listing or supply chain step, can reach the server if the platform fails to contain it. The CVSS vector shows that attack complexity is high and privileges are required, so the risk is mostly about untrusted themes and weak admin account hygiene. The record does not mark the CVE as exploited in the wild.
Quick check
Is a theme from the official marketplace safe?
The advisory advises avoiding untrusted themes. Sources you trust are better, but review and upgrade regardless, since the real fix is in 6.19.1.
Sources
Last reviewed: 19 October 2026.
