Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

TryGhost/Ghost

              main @ 73612b1
            

191

Fixes

CVEs

CRITICAL

Peak severity

32.4%

Coverage

Highlights

Auth Bypass: 74 prior fixes. Scrutinize any change in this area.

core/server/api/canary/settings.js: most-fixed (4 issues). Treat as high-risk during review.

148 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The most frequent vulnerability class, with 74 fixes. Many endpoints (collections, mentions, links, subscribers) lacked permission checks entirely, and staff tokens could inherit API key permissions, bypassing role-based authorization.

Stored XSS: 18 stored XSS fixes across theme helpers, Koenig node renderers, ActivityPub components, and Portal. Unsanitized HTML is rendered via SafeString, dangerouslySetInnerHTML, and email templates.

SSRF: Multiple components fetched external URLs without blocking internal IPs. Fixes centralize on a hardened externalRequest library, but sibling paths (oEmbed, webhooks, image size, media inliner) each needed individual routing to it.