High severity8.8NVD Advisory· Published Jun 10, 2026· Updated Jun 11, 2026

CVE-2026-52758

Description

Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. Remote attackers can inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data in the PostgreSQL database.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nationalsecurityagency/Ghidrallm-fuzzy
Range: <12.1

Patches

Vulnerability mechanics

References

github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8r4f-65cr-fwxmnvdVendor Advisory
www.vulncheck.com/advisories/ghidra-sql-injection-via-unescaped-filter-values-in-bsim-searchnvdThird Party Advisory

News mentions

National Security Agency's Ghidra: 15 Vulnerabilities Disclosed on June 10, 2026
Vypr Intelligence · Jun 10, 2026

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000