GHSA-wfrj-qqc2-83cm
Remote command injection when using sendmail email transport
Impact
Sites using the sendmail transport as part of their mail config are vulnerable to remote command injection due to a vulnerability in the nodemailer dependency.
Ghost defaults to the direct transport so this is only exploitable if the sendmail transport is explicitly used.
Patches
Fixed in 4.15.0, all sites should upgrade as soon as possible.
Workarounds
- Use an alternative email transport as described in the docs.
For more information
If you have any questions or comments about this advisory:
- email us at security@ghost.org
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
Remote command injection when using sendmail email transport
Impact
Sites using the sendmail transport as part of their mail config are vulnerable to remote command injection due to a vulnerability in the nodemailer dependency.
Ghost defaults to the direct transport so this is only exploitable if the sendmail transport is explicitly used.
Patches
Fixed in 4.15.0, all sites should upgrade as soon as possible.
Workarounds
- Use an alternative email transport as described in the docs.
For more information
If you have any questions or comments about this advisory:
- email us at security@ghost.org
- Record
GHSA-wfrj-qqc2-83cm- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Weakness
- CWE-88
- Updated
- 2026-11-02
OSV
Remote command injection when using sendmail email transport
Impact
Sites using the sendmail transport as part of their mail config are vulnerable to remote command injection due to a vulnerability in the nodemailer dependency.
Ghost defaults to the direct transport so this is only exploitable if the sendmail transport is explicitly used.
Patches
Fixed in 4.15.0, all sites should upgrade as soon as possible.
Workarounds
- Use an alternative email transport as described in the docs.
For more information
If you have any questions or comments about this advisory:
- email us at security@ghost.org
- Record
GHSA-wfrj-qqc2-83cm- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Weakness
- CWE-88
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ghostnpm | before 4.15.0 | 4.15.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-wfrj-qqc2-83cm is a medium vulnerability (CVSS 5.8) in ghost, published September 20, 2021. No source lists public exploit code. Fixed in ghost 4.15.0.