Listen to this Post
How CVE-2026-70588 Works
Ghost is a Node.js-based content management system. CVE-2026-70588 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Universal Import feature in Ghost Admin. This feature allows administrators to import content—including posts, pages, and tags—from external sources or backups.
The root cause is improper sanitization of imported content. When an administrator uses the Universal Import feature, the system fails to neutralize potentially malicious input embedded within the imported data. Specifically, it does not adequately strip or escape HTML tags, including `
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent may adversely affect certain features and functions.
We do not sell your personal data. If you wish to exercise your rights under applicable privacy laws, please visit our Do Not Sell My Personal Information page.