Exploitation Summary
EIP tracks 2 public exploits for CVE-2026-29053. PoCs published by AC8999, rootxran.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-29053, targeting Ghost CMS <= 6.19.0 via a malicious theme with crafted Handlebars templates. The exploit leverages the `jsonpath` package's unsafe use of `static-eval` to achieve remote code execution.
Description
Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.
Exploits (2)
This repository contains a functional exploit for CVE-2026-29053, targeting Ghost CMS <= 6.19.0 via a malicious theme with crafted Handlebars templates. The exploit leverages the `jsonpath` package's unsafe use of `static-eval` to achieve remote code execution.
This repository contains a functional exploit for CVE-2026-29053, a Ghost CMS RCE vulnerability via prototype pollution in jsonpath/static-eval. The exploit generates a malicious theme that executes arbitrary code when uploaded and rendered.
References (1)
Scores
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H