Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-52758

Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. Remote attackers can inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data in the PostgreSQL database.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nationalsecurityagency ghidra

Default version status: unaffected

  • 11.0 to < 12.1affected
  • 12.1unaffected
pkg:github/nationalsecurityagency/ghidra

References