CVE-2026-52750 is a command injection vulnerability affecting Ghidra before version 12.1 on Windows platforms. The issue stems from improper neutralization of argument delimiters in URL annotation handling, where cmd.exe metacharacters are not escaped correctly. This allows attackers to craft malicious URLs embedded in program comments that, when clicked by a user, execute arbitrary commands under the user's privileges. The vulnerability requires local access and user interaction, with high impact on confidentiality, integrity, and availability.

Successful exploitation enables attackers to execute arbitrary commands on the victim's system with the privileges of the Ghidra user. This can lead to unauthorized system access, data manipulation, or disruption of operations. The attack requires the victim to click a malicious URL embedded in program comments, and it is limited to Windows environments due to cmd.exe involvement.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking URLs in program comments within Ghidra, especially on Windows systems. Avoid opening untrusted or suspicious project files containing URL annotations.