Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arbitrary commands under the Ghidra user's privileges by embedding malicious URLs in program comments that victims click.
CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNsa Ghidra
APPNsa< 12.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2023-22671CRITICAL9.8PL ✓same product
Command injection w NSA Ghidra przez skrypt launch.sh
CVE-2019-16941CRITICAL9.8PL ✓same product
NSA Ghidra — RCE przez złośliwy plik XML w Bit Patterns Explorer
CVE-2019-13625CRITICAL9.1PL ✓same product
XXE w NSA Ghidra — odczyt plików i możliwy RCE przy otwieraniu projektu
CVE-2026-49498HIGH8.7same product
Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunct...
CVE-2026-52751HIGH8.6same product
Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connecti...