CVE-2026-53950: CVE-2026-53950: DOM-based Cross-Site Scripting in @tryghost/activitypub

#security #cve #cybersecurity

CVE-2026-53950: DOM-based Cross-Site Scripting in @tryghost/activitypub

Vulnerability ID: CVE-2026-53950
CVSS Score: 7.5
Published: 2026-08-04

A high-severity Cross-Site Scripting (XSS) vulnerability was identified in the @tryghost/activitypub package, the social and federation client library for the Ghost publishing platform. Prior to version 3.1.0, the ActivityPub client rendered incoming federated posts from external servers directly in the web user interface without proper sanitization. A maliciously customized ActivityPub server federated with a Ghost instance could transmit crafted posts containing embedded HTML payloads. When viewed by a user inside the ActivityPub client interface, the browser executes the injected JavaScript within the security context of the Ghost application domain.

TL;DR

Unsanitized rendering of federated ActivityPub posts in @tryghost/activitypub prior to 3.1.0 allows remote attackers to execute arbitrary JavaScript in the context of Ghost administrators.

Technical Details

CWE ID: CWE-79
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 7.5 (High)
EPSS Score: 0.00204 (10.597% percentile)
Exploit Status: No known public exploits
CISA KEV Status: Not Listed

Affected Systems

Ghost Publishing Platform
@tryghost/activitypub package
@tryghost/activitypub: < 3.1.0 (Fixed in: 3.1.0)

Mitigation Strategies

Upgrade @tryghost/activitypub to 3.1.0 or later
Implement Content Security Policy (CSP) headers on Ghost Admin interface
Temporarily restrict federation with untrusted nodes

Remediation Steps:

Navigate to the Ghost home directory.
Execute the 'ghost update' command to pull down corrected dependency updates.
Confirm the package resolution within the yarn.lock or package-lock.json of the application.