---
id: CVE-2026-53950
aliases:
  - GHSA-xpp7-93x6-v29m
title: XSS in Ghost's ActivityPub client
summary: XSS in Ghost's ActivityPub client
severity: high
cvss: 7.5
cwe:
  - CWE-79
vendor: tryghost
product: '@tryghost/activitypub'
ecosystem: npm
affected:
  - '@tryghost/activitypub < 3.1.0'
patched:
  - '@tryghost/activitypub 3.1.0'
published: '2026-08-04'
updated: '2026-08-04'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-xpp7-93x6-v29m'
references:
  - url: 'https://github.com/TryGhost/Ghost/security/advisories/GHSA-xpp7-93x6-v29m'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53950'
  - url: 'https://github.com/advisories/GHSA-xpp7-93x6-v29m'
tags:
  - ghsa
  - npm
epss: 0.00352
epssPercentile: 0.26215
ingestedAt: '2026-08-04T22:42:37.914Z'
---

## Overview

### Impact

The ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server.

### Vulnerable Versions

This vulnerability is present in the @tryghost/activitypub package up to v3.0.8. All prior versions are also affected. 

### Patches

@tryghost/activitypub v3.1.0 contains a fix for this issue and is also automatically fetched by Ghost.

### References

Ghost thanks Brad Geesaman, Ghost Security for disclosing this vulnerability responsibly. 

### For more information

If you have any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).

## Affected packages

- `@tryghost/activitypub < 3.1.0`

## Remediation

Upgrade to a patched release:

- `@tryghost/activitypub 3.1.0`