~ / search / GHSA-xgwh-cgv9-783v

GHSA-xgwh-cgv9-783v

Ghost allows CSV Injection during member CSV export

Source: GitHub Advisory Database (reviewed) High CVE-2024-34448

Packages

EcosystemPackageAffectedFixed in
npm @tryghost/members-csv < 5.82.0 5.82.0

Details

As written in the advisory (Markdown source, shown as plain text).

Ghost before 5.82.0 allows CSV Injection during a member CSV export.

References

External links from the advisory. They lead to third-party sites.