NSA Ghidra versions before 12.0.3 improperly neutralize special elements used in OS commands, specifically the @execute annotation in comments generated during automatic binary analysis. This leads to an OS command injection vulnerability (CWE-78) where attacker-controlled commands can be executed on the analyst's machine when interacting with crafted clickable text in the UI. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity with network attack vector, low complexity, no privileges required, but requiring user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary OS commands on the analyst's machine by tricking them into clicking maliciously crafted text in the Ghidra UI. This can lead to full compromise of the analyst's system, including data theft, system modification, or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Analysts should avoid opening or interacting with untrusted or suspicious binaries in Ghidra versions prior to 12.0.3. Until an official fix is available, exercising caution with auto-analysis results and disabling or restricting clickable annotations may reduce risk.