{
  "credits": [],
  "cve_id": "CVE-2026-26980",
  "cvss": {
    "score": 9.4,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.4,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-89",
      "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
    }
  ],
  "description": "### Impact\n\nA SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database. \n\n### Vulnerable Versions\n\nThis vulnerability is present in Ghost v3.24.0 to v6.19.0.\n\n### Patches\n\nv6.19.1 contains a fix for this issue.\n\n### Workarounds\n\nThere is no application-level workaround. The Content API key is public by design, so restricting key access does not mitigate this vulnerability.\n\nAs a temporary mitigation, a reverse proxy or WAF rule can be used to block Content API requests containing `slug%3A%5B` or `slug:[` in the query string filter parameter. Note that this may break legitimate slug filter functionality.\n\n### References\n\nWe thank Nicholas Carlini using Claude, Anthropic for disclosing this vulnerability responsibly. \n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).",
  "ghsa_id": "GHSA-w52v-v783-gw97",
  "github_reviewed_at": "2026-02-18T21:50:23Z",
  "html_url": "https://github.com/advisories/GHSA-w52v-v783-gw97",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-w52v-v783-gw97"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-26980"
    }
  ],
  "nvd_published_at": null,
  "published_at": "2026-02-18T21:50:23Z",
  "references": [
    "https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97",
    "https://github.com/TryGhost/Ghost/commit/30868d632b2252b638bc8a4c8ebf73964592ed91",
    "https://github.com/TryGhost/Ghost/releases/tag/v6.19.1",
    "https://github.com/advisories/GHSA-w52v-v783-gw97"
  ],
  "repository_advisory_url": "https://api.github.com/repos/TryGhost/Ghost/security-advisories/GHSA-w52v-v783-gw97",
  "severity": "critical",
  "source_code_location": "https://github.com/TryGhost/Ghost",
  "summary": "Ghost has a SQL injection in Content API",
  "type": "reviewed",
  "updated_at": "2026-02-18T21:50:25Z",
  "url": "https://api.github.com/advisories/GHSA-w52v-v783-gw97",
  "vulnerabilities": [
    {
      "first_patched_version": "6.19.1",
      "package": {
        "ecosystem": "npm",
        "name": "ghost"
      },
      "vulnerable_functions": [],
      "vulnerable_version_range": ">= 3.24.0, < 6.19.1"
    }
  ],
  "withdrawn_at": null
}