CVE-2026-52750 is a command injection vulnerability affecting Ghidra before version 12.1 on Windows platforms. The issue stems from improper neutralization of argument delimiters in URL annotation handling, where cmd.exe metacharacters are not escaped correctly. This allows an attacker to embed malicious URLs in program comments that, when clicked by the user, execute arbitrary commands under the user's privileges. The vulnerability requires user interaction and has high attack complexity and privileges required, but results in high impact on confidentiality, integrity, and availability.

Successful exploitation enables an attacker to execute arbitrary commands on the victim's Windows system with the same privileges as the Ghidra user. This can lead to unauthorized system access, data compromise, or disruption of operations. The attack requires the victim to click a malicious URL embedded in program comments, making social engineering a factor. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking URLs in program comments within Ghidra, especially from untrusted sources. Avoid opening suspicious or unexpected annotations containing URLs.