CVE-2026-26980 — Ghost has a SQL Injection in its Content API

Affected: TryGhost Ghost

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

GHSA-w52v-v783-gw97 — Ghost has a SQL injection in Content API

Affected: npm: ghost

### Impact

A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database.

### Vulnerable Versions

This vulnerability is present in Ghost v3.24.0 to v6.19.0.

### Patches

v6.19.1 contains a fix for this issue.

**Note:** as this vulnerability lets an attacker gain access to a site's API keys, we recommend reviewing staff users and rotating keys. We generally recommend always updating Ghost to its most current version.

### Workarounds

There is no application-level workaround. The Content API key is public by design, so restricting key access does not mitigate this vulnerability.

As a temporary mitigation, a reverse proxy or WAF rule can be used to block Content API requests containing `slug%3A%5B` or `slug:[` in the query string filter parameter. Note that this may break legitimate slug filter functionality.

### References

We thank Nicholas Carlini using Claude, Anthropic for disclosing this vulnerability responsibly.

### For more information If you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).

Most recent entries from all

CVE-2026-26980 — Ghost has a SQL Injection in its Content API

GHSA-w52v-v783-gw97 — Ghost has a SQL injection in Content API