@tryghost/portal vulnerabilities (npm)

2 vulnerabilities.

• @tryghost/portal npm Ghost vulnerable to XSS via malicious Portal preview links CVE-2026-24778 Fix available 8.8 HighJanuary 27, 2026
• @tryghost/portal npm Ghost's improper authentication allows access to member information and actions CVE-2024-43409 Fix available 6.5 MediumAugust 20, 2024