{"id":"CVE-2026-53950","aliases":["GHSA-xpp7-93x6-v29m"],"title":"XSS in Ghost's ActivityPub client","summary":"XSS in Ghost's ActivityPub client","severity":"high","cvss":7.5,"cwe":["CWE-79"],"vendor":"tryghost","product":"@tryghost/activitypub","ecosystem":"npm","affected":["@tryghost/activitypub < 3.1.0"],"patched":["@tryghost/activitypub 3.1.0"],"published":"2026-08-04","updated":"2026-08-04","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-xpp7-93x6-v29m","references":[{"url":"https://github.com/TryGhost/Ghost/security/advisories/GHSA-xpp7-93x6-v29m"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53950"},{"url":"https://github.com/advisories/GHSA-xpp7-93x6-v29m"}],"tags":["ghsa","npm"],"epss":0.00352,"epssPercentile":0.2612,"ingestedAt":"2026-08-04T22:42:37.914Z","slug":"CVE-2026-53950","body":"## Overview\n\n### Impact\n\nThe ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server.\n\n### Vulnerable Versions\n\nThis vulnerability is present in the @tryghost/activitypub package up to v3.0.8. All prior versions are also affected. \n\n### Patches\n\n@tryghost/activitypub v3.1.0 contains a fix for this issue and is also automatically fetched by Ghost.\n\n### References\n\nGhost thanks Brad Geesaman, Ghost Security for disclosing this vulnerability responsibly. \n\n### For more information\n\nIf you have any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).\n\n## Affected packages\n\n- `@tryghost/activitypub < 3.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@tryghost/activitypub 3.1.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}