{"uuid": "71f1a7e1-23fd-42d3-a826-27a38997f0d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xpp7-93x6-v29m", "type": "seen", "source": "https://gist.github.com/alon710/3fbc424d9726688cb9c9bb1b3b35fa73", "content": "# CVE-2026-53950: CVE-2026-53950: DOM-based Cross-Site Scripting in @tryghost/activitypub\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53950\n\n## Summary\nA high-severity Cross-Site Scripting (XSS) vulnerability was identified in the @tryghost/activitypub package, the social and federation client library for the Ghost publishing platform. Prior to version 3.1.0, the ActivityPub client rendered incoming federated posts from external servers directly in the web user interface without proper sanitization. A maliciously customized ActivityPub server federated with a Ghost instance could transmit crafted posts containing embedded HTML payloads. When viewed by a user inside the ActivityPub client interface, the browser executes the injected JavaScript within the security context of the Ghost application domain.\n\n## TL;DR\nUnsanitized rendering of federated ActivityPub posts in @tryghost/activitypub prior to 3.1.0 allows remote attackers to execute arbitrary JavaScript in the context of Ghost administrators.\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00204 (10.597% percentile)\n- **Exploit Status**: No known public exploits\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ghost Publishing Platform\n- @tryghost/activitypub package\n- **@tryghost/activitypub**: < 3.1.0 (Fixed in: `3.1.0`)\n\n## Mitigation\n\n- Upgrade @tryghost/activitypub to 3.1.0 or later\n- Implement Content Security Policy (CSP) headers on Ghost Admin interface\n- Temporarily restrict federation with untrusted nodes\n\n**Remediation Steps:**\n1. Navigate to the Ghost home directory.\n2. Execute the 'ghost update' command to pull down corrected dependency updates.\n3. Confirm the package resolution within the yarn.lock or package-lock.json of the application.\n\n## References\n\n- [GitHub Security Advisory GHSA-xpp7-93x6-v29m](https://github.com/TryGhost/Ghost/security/advisories/GHSA-xpp7-93x6-v29m)\n- [NVD Detail CVE-2026-53950](https://nvd.nist.gov/vuln/detail/CVE-2026-53950)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-53950)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53950) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T00:31:06.087712Z"}