Executive brief
Ghidra is a software reverse engineering suite used by security researchers and developers. A vulnerability in its BSim component allows a user with basic database access to execute unauthorized commands on the underlying PostgreSQL server. This could lead to a total takeover of the database, allowing an attacker to steal sensitive research data, modify system configurations, or potentially gain control of the host operating system.
Technical details
A SQL injection vulnerability exists in the `changePassword()` method of the `PostgresFunctionDatabase` class within Ghidra's BSim feature. The application fails to escape double quotes in usernames before interpolating them into `ALTER ROLE` SQL statements. An authenticated attacker can send a crafted `PasswordChange` network message containing a malicious username to break out of the quoted identifier. This allows the execution of arbitrary SQL commands with the privileges of the database service, leading to PostgreSQL superuser escalation and potential remote code execution via PostgreSQL features like `COPY PROGRAM`. The issue is fixed in Ghidra version 12.1.
Affected products
- NSA Ghidra 11.0 to 12.0.x
Timeline
- 2026-05-14: advisory: Initial GitHub Security Advisory published by NSA
- 2026-06-10: disclosed: CVE-2026-49498 published and added to NVD
- 2026-06-10: patched: Vulnerability addressed in version 12.1