Ghost Remote Code Execution Vulnerability via Malicious Themes

A remote code execution vulnerability has been identified in Ghost, a Node.js content management system, affecting versions 0.7.2 prior to 6.19.0. This vulnerability allows specifically crafted malicious themes to execute arbitrary code on the server where Ghost is running. The issue has been patched in Ghost version 6.19.1.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server running Ghost.

Remediation

Users are advised to update to Ghost version 6.19.1, which includes a fix for this vulnerability. It is also recommended to avoid installing untrusted themes. If a malicious theme has already been installed, it should be uninstalled and inspected to understand its impact.