We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-70594

CVE-2026-70594

Node.js

Severity: MEDIUM
CVSS: 6.7CVSS
Published: 2026-08-04
Last modified: 2026-08-04
CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
CWE: CWE-384

Description

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. This issue is fixed in version 6.54.1.

References

https://github.com/TryGhost/Ghost/commit/6b1c85c30dd0bacb4d5ffe64fc675ac9342d800c
https://github.com/TryGhost/Ghost/pull/29634
https://github.com/TryGhost/Ghost/releases/tag/v6.54.1
https://github.com/TryGhost/Ghost/security/advisories/GHSA-7mpp-r37j-x5wh

Summary

Description

References