Command Injection via URL Annotation Click

Not long ago, a vulnerability discovered in Ghidra was publicly disclosed.

I use Ghidra even more frequently than many smartphone applications…lol, so this case particularly caught my attention. Ironically, a tool designed to help analysts safely inspect potentially malicious binaries could itself have been turned into a weapon to compromise the analyst’s PC.

Ghidra, the open-source reverse engineering tool released by the NSA, supports annotations such as {@url …} inside program comments. When an analyst clicks one of these annotations, Ghidra opens the specified URL in a web browser.

The problem was how this URL was handled on Windows. By default, it was opened using:

cmd.exe /c start <URL>

The URL string was passed directly as a command-line argument without sufficient escaping.

Java’s Windows argument-escaping logic mainly considers spaces and double quotes. However, shell metacharacters interpreted by cmd.exe, such as &, \|, and ^, were not handled appropriately. To make matters worse, some of these characters are valid under URI syntax, meaning they could pass the URL-parsing stage without being rejected.

Although the conditions required to exploit this vulnerability may be relatively uncommon, the fact that it was realistically reproducible made the case especially interesting. It was also striking to see a vulnerability discovered in a tool that I use almost every day.

More than anything, this case was a good reminder that even the tools we rely on to discover and analyze security vulnerabilities can themselves contain vulnerabilities.

Reference

https://www.cve.org/CVERecord?id=CVE-2026-52750 https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-5c38-3rf3-gp75