Nixpkgs security tracker
5.4 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): Required (R)
- Scope (S): Changed (C)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Ghost: Mobiledoc image-size fetch SSRF
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card at an attacker-chosen host and cause the Ghost server to request it on their behalf, including hosts on internal networks or cloud instance metadata endpoints that would not normally be reachable from the public internet. This vulnerability is fixed in 6.21.1.
References
-
https://github.com/TryGhost/Ghost/security/advisories/GHSA-g366-23fw-ggp6 x_refsource_CONFIRM
Affected products
- ==>= 6.19.4, < 6.21.1
Matching in nixpkgs
pkgs.ghost
Android post-exploitation framework
-
nixos-unstable -
- nixos-unstable-small 8.0.0-unstable-2025-11-01
-
nixos-26.05 -
- nixos-26.05-small 8.0.0-unstable-2025-11-01
pkgs.ghostie
Github notifications in your terminal
pkgs.ghostty
Fast, native, feature-rich terminal emulator pushing modern features
pkgs.ghost-cli
CLI Tool for installing & updating Ghost
pkgs.ghostfolio
Open Source Wealth Management Software
pkgs.ghostunnel
TLS proxy with mutual authentication support for securing non-TLS backend applications
pkgs.ghostscript
PostScript interpreter (mainline version)
pkgs.ghosttohugo
Convert Ghost export to Hugo posts
pkgs.ghostty-bin
Fast, native, feature-rich terminal emulator pushing modern features
pkgs.ghostscriptX
PostScript interpreter (mainline version)
pkgs.libghostty-vt
Ghostty's VT (terminal sequence) parsing library
-
nixos-unstable -
- nixos-unstable-small 0.1.0-unstable-2026-05-03
-
nixos-26.05 -
- nixos-26.05-small 0.1.0-unstable-2026-05-03
pkgs.ghost-complete
Terminal-native autocomplete engine using PTY proxying for macOS terminals
pkgs.ghostscript_headless
PostScript interpreter (mainline version)
pkgs.kdePackages.ghostwriter
Text editor for Markdown
pkgs.python313Packages.aioghost
Async Python client for the Ghost Admin API
pkgs.python314Packages.aioghost
Async Python client for the Ghost Admin API
pkgs.haskellPackages.ghost-buster
Existential type utilites
pkgs.python312Packages.ghostscript
None
pkgs.python313Packages.ghostscript
Interface to the Ghostscript C-API using ctypes
pkgs.python314Packages.ghostscript
Interface to the Ghostscript C-API using ctypes
pkgs.haskellPackages.ghostscript-parallel
Let Ghostscript render pages in parallel
pkgs.tree-sitter-grammars.tree-sitter-ghostty
Tree-sitter grammar for ghostty
-
nixos-unstable -
- nixos-unstable-small 1.3.1-unstable-2026-06-03
-
nixos-26.05 -
- nixos-26.05-small 1.3.0-unstable-2026-04-24
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-ghostty
Python bindings for tree-sitter-ghostty
-
nixos-unstable -
- nixos-unstable-small 1.3.1+unstable20260603
-
nixos-26.05 -
- nixos-26.05-small 1.3.0+unstable20260424
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-ghostty
Python bindings for tree-sitter-ghostty
-
nixos-unstable -
- nixos-unstable-small 1.3.1+unstable20260603
-
nixos-26.05 -
- nixos-26.05-small 1.3.0+unstable20260424