Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.8
Ghost Email Transport Vulnerability: Remote Command Injection
published 5 years ago
Summary
Ghost sites using the sendmail email transport are vulnerable to a remote attack that could allow an attacker to execute commands on the server. This only affects sites that explicitly use sendmail in their email settings. To fix this, update Ghost to version 4.15.0 or use an alternative email transport.
What to do
- Update ghost-slimer ghost to version 4.15.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | ghost-slimer | ghost |
< 4.15.0 Fix: upgrade to 4.15.0
|
Original advisory text
Remote command injection when using sendmail email transport
### Impact
Sites using the `sendmail` transport as part of their `mail` config are vulnerable to remote command injection due to a [vulnerability](https://github.com/advisories/GHSA-48ww-j4fc-435p) in the `nodemailer` dependency.
Ghost defaults to the `direct` transport so this is only exploitable if the `sendmail` transport is explicitly used.
### Patches
Fixed in 4.15.0, all sites should upgrade as soon as possible.
### Workarounds
* Use an alternative email transport as described in the [docs](https://ghost.org/docs/config/#mail).
### For more information
If you have any questions or comments about this advisory:
* email us at [email protected]
Sites using the `sendmail` transport as part of their `mail` config are vulnerable to remote command injection due to a [vulnerability](https://github.com/advisories/GHSA-48ww-j4fc-435p) in the `nodemailer` dependency.
Ghost defaults to the `direct` transport so this is only exploitable if the `sendmail` transport is explicitly used.
### Patches
Fixed in 4.15.0, all sites should upgrade as soon as possible.
### Workarounds
* Use an alternative email transport as described in the [docs](https://ghost.org/docs/config/#mail).
### For more information
If you have any questions or comments about this advisory:
* email us at [email protected]
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published20 Sep 2021
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-wfrj-qqc2-83cm · GHSA
Track software like this
Free during beta