Product

@Tryghost/Activitypub (< 3.1.0)

1 brief RSS

Cross-Site Scripting Vulnerability in Ghost ActivityPub Client

An XSS vulnerability in the @tryghost/activitypub package (CVE-2026-53950) allows attackers to inject arbitrary JavaScript via malicious ActivityPub server posts.

@tryghost/activitypub xss web-vulnerability activitypub

1t 1c 1d ago