PT-2026-48410 · U.S. National Security Agency · Ghidra

Ruffalo Lavoisier · Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-52750

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arbitrary commands under the Ghidra user's privileges by embedding malicious URLs in program comments that victims click.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-52750

Affected Products

Ghidra

References · 3

• https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-5c38-3rf3-gp75 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-52750 · Security Note
• https://vulncheck.com/advisories/ghidra-command-injection-via-url-annotation-click · Note