Nsa
Monthly
Command injection in NSA Ghidra (versions before 12.0.3) executes arbitrary commands when analysts click on maliciously crafted binary comments. Attackers embed @execute annotation directives in binary data (e.g., CFStrings in Mach-O files) that Ghidra auto-extracts and renders as clickable UI elements, bypassing the intended trust boundary for user-authored annotations. No public exploit identified at time of analysis, though the attack vector is well-documented in vendor advisory. EPSS data not available; CVSS 8.8 reflects high impact contingent on user interaction with a weaponized binary file.
Ghidra releases before 12.2 extract extension ZIP archives without any cap on entry count, so a crafted archive containing a very large number of files can exhaust the local filesystem's inode pool and cause project writes, index flushes, and other host processes to fail. The flaw is availability-only: no confidentiality or integrity impact is assessed, and no credentials are needed, but an attacker must first persuade a victim to install the malicious archive through Ghidra's extension installer (local access plus user interaction). No public exploit code has been identified at time of analysis, and the aggregated signals place this at a 'this_month' priority rather than an emergency; the vendor-released patch is Ghidra 12.2.
Disk-space exhaustion in Ghidra 10.3 through 12.1 lets a crafted theme ZIP fill the host filesystem through the theme importer's icon extraction path. When a user is persuaded to import the archive, icon entries in the image/ subdirectory are written to ~/.config/ghidra/Ghidra*/images without any cap on decompressed size or compression ratio, so a small archive can expand until the partition is full, after which theme imports and other disk-writing applications fail. The flaw is availability-only - no code execution, privilege gain, or data disclosure - and there is no public exploit identified at time of analysis; exploitation requires local interaction with the import feature and user interaction, giving it a medium-severity, this-month remediation priority rather than emergency status.
Inode and disk-space exhaustion in Ghidra 10.3 through 12.1 allows an attacker who can convince a user to import a crafted theme ZIP archive to fill the host filesystem, causing Ghidra's own theme imports and other disk-dependent operations to fail. The flaw sits in ThemeReader.readZipTheme(), which extracts every entry under the archive's image/ directory into ~/.config/ghidra/Ghidra*/images without counting entries or bounding total size; an archive containing a very large number of tiny icon files drains the inode pool. The trigger is local and gated on user interaction (the victim must actively import the untrusted theme), so there is no remote or unauthenticated path, and the impact depends heavily on the target filesystem's free inodes and disk space. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the upstream fix commit caps extracted icon entries at 3000 and Ghidra 12.2 ships that cap.
Heap exhaustion in Ghidra's GZF packed-database import path can crash the JVM when a user or automated headless pipeline opens a crafted DB file whose BinaryField length is set to an arbitrarily large value. The issue is local and requires the victim to import the file; impact is availability-only (OutOfMemoryError, aborted import, and loss of unsaved work), and the supplied data records no public exploit at time of analysis. Version scope is conflicting across sources: the GHSA lists vulnerable versions below 12.2 with the fix in 12.2, while the NVD description and independent assessment refer to Ghidra through 12.2.
XML External Entity (XXE) injection in GRASSMARLIN v3.2.1 allows authenticated local users to extract sensitive information through crafted session data that exploits insufficient XML parser hardening. The vulnerability has a CVSS score of 5.5 with local attack vector and high confidentiality impact, affecting users with login credentials on systems running the affected version.
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Emissary is a P2P-based, data-driven workflow engine. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Emissary is a P2P based data-driven workflow engine. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Emissary is a distributed, peer-to-peer, data-driven workflow framework. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
The ConfigFileAction component of U.S. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The ConsoleAction component of U.S. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
U.S. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
U.S. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
NSA Ghidra through 9.0.4 uses a potentially untrusted search path. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Command injection in NSA Ghidra (versions before 12.0.3) executes arbitrary commands when analysts click on maliciously crafted binary comments. Attackers embed @execute annotation directives in binary data (e.g., CFStrings in Mach-O files) that Ghidra auto-extracts and renders as clickable UI elements, bypassing the intended trust boundary for user-authored annotations. No public exploit identified at time of analysis, though the attack vector is well-documented in vendor advisory. EPSS data not available; CVSS 8.8 reflects high impact contingent on user interaction with a weaponized binary file.
Ghidra releases before 12.2 extract extension ZIP archives without any cap on entry count, so a crafted archive containing a very large number of files can exhaust the local filesystem's inode pool and cause project writes, index flushes, and other host processes to fail. The flaw is availability-only: no confidentiality or integrity impact is assessed, and no credentials are needed, but an attacker must first persuade a victim to install the malicious archive through Ghidra's extension installer (local access plus user interaction). No public exploit code has been identified at time of analysis, and the aggregated signals place this at a 'this_month' priority rather than an emergency; the vendor-released patch is Ghidra 12.2.
Disk-space exhaustion in Ghidra 10.3 through 12.1 lets a crafted theme ZIP fill the host filesystem through the theme importer's icon extraction path. When a user is persuaded to import the archive, icon entries in the image/ subdirectory are written to ~/.config/ghidra/Ghidra*/images without any cap on decompressed size or compression ratio, so a small archive can expand until the partition is full, after which theme imports and other disk-writing applications fail. The flaw is availability-only - no code execution, privilege gain, or data disclosure - and there is no public exploit identified at time of analysis; exploitation requires local interaction with the import feature and user interaction, giving it a medium-severity, this-month remediation priority rather than emergency status.
Inode and disk-space exhaustion in Ghidra 10.3 through 12.1 allows an attacker who can convince a user to import a crafted theme ZIP archive to fill the host filesystem, causing Ghidra's own theme imports and other disk-dependent operations to fail. The flaw sits in ThemeReader.readZipTheme(), which extracts every entry under the archive's image/ directory into ~/.config/ghidra/Ghidra*/images without counting entries or bounding total size; an archive containing a very large number of tiny icon files drains the inode pool. The trigger is local and gated on user interaction (the victim must actively import the untrusted theme), so there is no remote or unauthenticated path, and the impact depends heavily on the target filesystem's free inodes and disk space. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the upstream fix commit caps extracted icon entries at 3000 and Ghidra 12.2 ships that cap.
Heap exhaustion in Ghidra's GZF packed-database import path can crash the JVM when a user or automated headless pipeline opens a crafted DB file whose BinaryField length is set to an arbitrarily large value. The issue is local and requires the victim to import the file; impact is availability-only (OutOfMemoryError, aborted import, and loss of unsaved work), and the supplied data records no public exploit at time of analysis. Version scope is conflicting across sources: the GHSA lists vulnerable versions below 12.2 with the fix in 12.2, while the NVD description and independent assessment refer to Ghidra through 12.2.
XML External Entity (XXE) injection in GRASSMARLIN v3.2.1 allows authenticated local users to extract sensitive information through crafted session data that exploits insufficient XML parser hardening. The vulnerability has a CVSS score of 5.5 with local attack vector and high confidentiality impact, affecting users with login credentials on systems running the affected version.
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Emissary is a P2P-based, data-driven workflow engine. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Emissary is a P2P based data-driven workflow engine. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Emissary is a distributed, peer-to-peer, data-driven workflow framework. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
The ConfigFileAction component of U.S. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The ConsoleAction component of U.S. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
U.S. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
U.S. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
NSA Ghidra through 9.0.4 uses a potentially untrusted search path. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.