PT-2026-48418 · Postgresql Global Development Group+1 · Postgresql+1

Sean Nejad · Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-52758

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.1

Description BSim filter types concatenate user-supplied values directly into SQL queries without escaping or parameterization. This allows remote attackers to inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data in the PostgreSQL database.

Recommendations Update to version 12.1.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-52758

Affected Products

Ghidra

Postgresql

References · 5

• 🔥 https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8r4f-65cr-fwxm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-52758 · Security Note
• https://twitter.com/VulmonFeeds/status/2064746104655081485 · Twitter Post
• https://twitter.com/CVEnew/status/2064709805176955385 · Twitter Post
• https://vulncheck.com/advisories/ghidra-sql-injection-via-unescaped-filter-values-in-bsim-search · Note