Summary
Ghost contains a stored cross-site scripting vulnerability in the handling of oEmbed photo responses, allowing untrusted scripts to be persisted through embedded content. When a malicious oEmbed response is accepted and rendered, the scripts may execute in the Ghost editor, published site, or newsletter emails, potentially compromising staff sessions.
Affected context
The vulnerability may affect Ghost deployments that accept externally hosted oEmbed photo responses and persist the resulting content. Risk increases when imported or embedded content is rendered in administrative editing views, published pages, or newsletter messages without sufficiently context-aware output encoding and sanitization.
Exploit preconditions
- Attack surface: oEmbed photo response processing and content rendering
- Required access: Ability to supply or cause ingestion of a malicious oEmbed photo URL or response
- Trigger point: Processing or rendering of the stored embedded content in the editor, website, or newsletter output
- Why exploitation is possible: Untrusted response data can be stored and later interpreted as active script rather than treated strictly as inert content
Why this happens
The underlying issue is insufficient validation and output encoding of untrusted oEmbed response data before it is stored and rendered. This creates a stored cross-site scripting condition mapped to CWE-79, where attacker-controlled content is interpreted as executable script in a browser context. The risk is amplified when the same content is rendered across multiple trust boundaries, including staff-facing interfaces and outbound communications.
Potential impact
- Attackers may execute scripts in staff administrators' browser sessions
- Session information or sensitive page data could be exposed
- Administrative actions could be performed using a compromised session context
- Published pages and newsletter content may be altered or used to distribute malicious content
- Visitor or subscriber trust could be undermined
General mitigation guidance
Mitigation generally focuses on treating all externally sourced oEmbed data as untrusted and ensuring it cannot become executable content.
Common defensive patterns include:
- Applying context-aware output encoding at every rendering destination
- Sanitizing embedded markup with a restrictive, allowlisted policy
- Validating oEmbed response fields against expected schemas and media types
- Avoiding direct insertion of untrusted HTML into privileged or email-rendered contexts
- Restricting administrative session privileges and using defense-in-depth browser policies such as Content Security Policy
- Preserving safe handling rules when content is rendered in editors, websites, and newsletters
How teams detect issues like this
Organizations can identify similar risks through:
- Static analysis rules for unsafe HTML insertion, template escaping bypasses, and direct rendering of oEmbed fields
- Code review checks covering external content ingestion, persistence, and reuse across rendering contexts
- Dynamic testing with benign script markers in oEmbed and other imported content
- Content-security and sanitization policy enforcement for editor, site, and email rendering paths
- Automated security review tools that flag untrusted data flows into browser-executable sinks
