CVE-2026-29053

This repository contains a functional exploit for CVE-2026-29053, targeting Ghost CMS <= 6.19.0 via a malicious theme with crafted Handlebars templates. The exploit leverages the `jsonpath` package's unsafe use of `static-eval` to achieve remote code execution.

This repository contains a functional exploit for CVE-2026-29053, a Ghost CMS RCE vulnerability via prototype pollution in jsonpath/static-eval. The exploit generates a malicious theme that executes arbitrary code when uploaded and rendered.