Threats affecting pkg:github/nationalsecurityagency/ghidra

CVE-2026-4946 is a high-severity OS command injection vulnerability in NSA Ghidra versions prior to 12.0.3. The issue arises because Ghidra improperly processes @execute annotations embedded in automatically extracted binary data during auto-analysis. This flaw allows a crafted binary to display clickable text in the UI that, when clicked by an analyst, executes arbitrary commands on the analyst's machine. The vulnerability affects local users interacting with the UI and requires user interaction to trigger. No official patch information is provided in the data, and no known exploits are reported in the wild.