CVE-2026-52758 Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search

What is CVE-2026-52758?

CVE-2026-52758 is a high-severity SQL injection vulnerability in nationalsecurityagency ghidra, published on 10 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. Remote attackers can inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data in the PostgreSQL database.

Weakness: CWE-89

Which versions are affected by CVE-2026-52758?

It affects 1 product.

Products include Nsa Ghidra.

How do I fix CVE-2026-52758?

No fix has been published for CVE-2026-52758 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-52758 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52758 exists.

Other vulnerabilities in nationalsecurityagency ghidra

• CVE-2023-22671 Command injection in n/a Critical 9.8
• CVE-2019-16941 XML external entity in n/a Critical 9.8
• CVE-2019-13625 XML external entity in n/a Critical 9.1
• CVE-2026-4946 NSA Ghidra Auto-Analysis Annotation Command Execution High 8.8
• CVE-2026-49498 Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8r4f-65cr-fwxm.