Impact Sites using the "sendmail" transport as part of their "mail" config are vulnerable to remote command injection due to a "vulnerability" (https://github.com/advisories/GHSA-48ww-j4fc-435p) in the "nodemailer" dependency. Ghost defaults to the "direct" transport so this is only exploitable if the "sendmail" transport is explicitly used. Patches Fixed in 4.15.0, all sites should upgrade as soon as possible. Workarounds * Use an alternative email transport as described in the "docs" (https://ghost.org/docs/config/#mail). For more information If you have any questions or comments about this advisory: * email us at security@ghost.org