PT-2026-48418 · Postgresql Global Development Group+1 · Postgresql+1

Sean Nejad · CVE-2026-52758 · Published 2026-06-10 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghidra versions prior to 12.1

Description BSim filter types concatenate user-supplied values directly into SQL queries without escaping or parameterization, leading to a SQL injection. This allows remote attackers to inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data within the PostgreSQL database.

Recommendations Update to version 12.1 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-52758

GHSA-8R4F-65CR-FWXM

Affected Products

Ghidra

Postgresql

References · 10

• 🔥 https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8r4f-65cr-fwxm · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52758.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-52758 · Security Note
• https://osv.dev/vulnerability/CVE-2026-52758 · Vendor Advisory
• https://github.com/nationalsecurityagency/ghidra · Note
• https://t.me/cveNotify/167044 · Telegram Post
• https://vulncheck.com/advisories/ghidra-sql-injection-via-unescaped-filter-values-in-bsim-search · Note
• https://t.me/CVEtracker/56452 · Telegram Post
• https://twitter.com/CVEnew/status/2064709805176955385 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2064746104655081485 · Twitter Post