Cross-Site Scripting Vulnerability in Ghost ActivityPub Client

A high-severity cross-site scripting (XSS) vulnerability, tracked as CVE-2026-53950, affects the @tryghost/activitypub package used by the Ghost platform. The vulnerability arises from improper sanitization of content ingested from remote ActivityPub servers. By configuring a malicious ActivityPub server, an attacker can craft posts containing arbitrary JavaScript payloads. When these posts are fetched and rendered by the Ghost ActivityPub client, the payload executes in the context of the user's session. This vulnerability impacts all versions of @tryghost/activitypub prior to 3.1.0. Defenders should note that Ghost instances automatically fetch the patched version (v3.1.0) upon release, but administrators should verify the version status of their local deployments to ensure the update has been applied.

Impact

Successful exploitation allows for unauthorized script execution in the context of the user viewing the malicious post. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or the exfiltration of sensitive information accessible through the browser session. All Ghost deployments utilizing the affected @tryghost/activitypub package are vulnerable if not updated to version 3.1.0 or later.

Recommendation

• Update the @tryghost/activitypub package to version 3.1.0 or later immediately to incorporate the sanitization fix for CVE-2026-53950.
• Review web server and application logs for suspicious inbound ActivityPub traffic if there is evidence of targeting.
• Audit the Ghost installation directory to confirm the current version of the @tryghost/activitypub dependency.