Executive brief
Ghidra is a reverse-engineering framework used by security analysts to examine and understand binary files. A malicious binary can trick analysts into executing attacker-controlled commands by embedding hidden instructions in what appear to be innocent comments. When an analyst clicks on these disguised links during code analysis, arbitrary commands execute on their machine with full access to their data and systems.
Technical details
The vulnerability is an OS command injection flaw in Ghidra's annotation processing. The @execute annotation feature, designed to allow trusted user-authored comments to trigger commands, is also parsed in comments automatically generated during binary analysis (specifically CFStrings extracted from Mach-O binaries by CFStringAnalyzer). The ExecutableTaskStringHandler parses and executes commands in the format {@execute /path/to/binary args DisplayText} directly via ProcessBuilder without validation, sanitization, or user confirmation. Attack requires a crafted binary and user interaction (clicking a link), but no elevated privileges. An attacker can achieve full code execution with analyst machine access. Patch available in version 12.0.3 and later.
Affected products
- National Security Agency Ghidra prior to 12.0.3
Timeline
- 2026-02-19: disclosed: GitHub Security Advisory GHSA-mc3p-mq2p-xw6v published
- 2026-03-29: advisory: CVE-2026-4946 published