A critical vulnerability in NSA Ghidra allows an attacker to achieve arbitrary command execution on the analyst's machine through the processing of crafted binary annotations.

This is an OS command injection flaw (CWE-78) where the software improperly parses @execute annotations within binary metadata. The vulnerability can be triggered by an unauthenticated attacker providing a malicious binary that, when analyzed, causes the Ghidra UI to execute arbitrary commands if a user clicks on the crafted text.

Successful exploitation of this vulnerability permits an attacker to execute arbitrary OS commands with the privileges of the Ghidra user. Given the CVSS score of 8.8, this represents a high risk to organizations that perform reverse engineering, as it could lead to full system compromise, exfiltration of sensitive internal research, or lateral movement into secure development environments.

Immediate Action: Upgrade to Ghidra version 12.0.3 or later immediately to incorporate the necessary input neutralization patches.

Proactive Monitoring: Review analyst workstations for unusual child processes spawned by the Ghidra binary or unexpected network connections originating from the Ghidra application.

Compensating Controls: Ensure that Ghidra instances are executed within isolated, non-privileged environments, such as a sandbox or a dedicated virtual machine, to minimize the impact of potential command execution.

Public Exploit Available: No (exploit_available: unknown)

Organizations utilizing Ghidra for security research or binary analysis must prioritize this update to prevent remote code execution on analyst workstations. Given the nature of the flaw, apply the 12.0.3 patch across all installations immediately to eliminate the risk of command injection via malicious binary files.