2026-07-19 18:38:32
PSA: if you have a self-hosted ghost blog, check the CVEs from time to time—specifically there was an issue where they didn't sanitize user input and enabled SQL injection which lead to people adding injected code in site header/footers.
If you don't use header/footer injection in posts, here's a quick SQL script to clean your db:
UPDATE posts SET codeinjection_head='', codeinjection_foot='';
Side note: I don't get why this is even a feature that's on by default (and can't be turned off).