github.com
https://github.com/TryGhost/Ghost CVE-2026-53950
HIGH
@tryghost/activitypub: XSS in Ghost's ActivityPub client
Record summary
CVE-2026-53950 has a selected CVSS score of 7.5 (high).
Description
@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 24, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | < 3.1.0 | affected | |
@tryghost/activitypubBrowse npm / @tryghost/activitypub | GitHub Advisory | Before 3.1.0 · Fixed in 3.1.0 | affected |
References
3github.comConfirmation
https://github.com/TryGhost/Ghost/security/advisories/GHSA-xpp7-93x6-v29m nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-53950