[GHSA-gjrp-xgmh-x9qq] Ghost has SQL Injection in Members Activity Feed

[kgnio]

Updates

• Affected products

Comments
The affected version range for Ghost 5.x is inconsistent with the advisory description.
The "Vulnerable versions" section states that the vulnerability affects Ghost v5.90.0 through v5.130.5, but the structured "Affected versions" field currently lists >= 5.105.0, <= 5.130.5.
The upstream Ghost security advisory also identifies v5.90.0 as the first affected version.
This change updates the affected range from:

= 5.105.0, <= 5.130.5
to:
= 5.90.0, <= 5.130.5
The patched version remains 5.130.6.

References:

• Upstream Ghost security advisory:
  GHSA-gjrp-xgmh-x9qq

• NVD CVE record:
  https://nvd.nist.gov/vuln/detail/CVE-2026-22596

[github]

Hi there @kevinansfield! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory