High severity7.8NVD Advisory· Published Jun 10, 2026· Updated Jun 11, 2026
CVE-2026-52750
CVE-2026-52750
Description
Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arbitrary commands under the Ghidra user's privileges by embedding malicious URLs in program comments that victims click.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*range: <12.1
- (no CPE)range: <12.1
Patches
Vulnerability mechanics
References
2- github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-5c38-3rf3-gp75nvdVendor Advisory
- www.vulncheck.com/advisories/ghidra-command-injection-via-url-annotation-clicknvdThird Party Advisory
News mentions
1- National Security Agency's Ghidra: 15 Vulnerabilities Disclosed on June 10, 2026Vypr Intelligence · Jun 10, 2026