PT-2026-48410 · Ghidra · Ghidra
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ghidra versions prior to 12.1
Description
On Windows, improper escaping of
cmd.exe metacharacters in URL annotation handling allows for command injection. This occurs when malicious URLs are embedded in program comments; if a user clicks these URLs, arbitrary commands can be executed with the privileges of the Ghidra user.Recommendations
Update to version 12.1 or later.
Exploit
Fix
Argument Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ghidra