Ghidra versions prior to 12.1 allow a database-level injection flaw through the BSim filter types. The flaw arises because user-supplied filter values are concatenated directly into SQL queries without any escaping or parameterization. An attacker who can send crafted BSim network queries can inject arbitrary SQL, which may then be executed against the PostgreSQL database used by Ghidra. This vulnerability permits the reading, modification, or deletion of database contents, exposing sensitive data and potentially compromising the integrity of Ghidra’s analysis environment.

The affected product is the National Security Agency’s Ghidra, a software reverse engineering suite. Versions of Ghidra earlier than 12.1 contain the vulnerable BSim component. The vulnerability is specific to the BSim network query mechanism used within Ghidra, which is typically exposed through local or network connections to the Ghidra application.

The CVSS score of 8.7 classifies this flaw as high severity. Although an EPSS score is not provided, the vulnerability is known to be exploitable through remote network access to the BSim interface. It is not listed in the CISA KEV catalog. Attackers with network access to the BSim protocol can craft malicious queries that bypass input validation, leading to uncontrolled SQL execution. The lack of parameterization gives the attacker full control over the SQL statement, providing a clear path to database compromise.