CVE-2019-17664: Nsa Ghidra

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

NSA Ghidra through 9.0.4 uses a potentially untrusted search path. When executing Ghidra from a given path, the Java process working directory is set to this path. Then, when launching the Python interpreter via the "Ghidra Codebrowser > Window > Python" option, Ghidra will try to execute the cmd.exe program from this working directory.

Affected products

• Nsa Ghidra: up to and including 9.0.4

Published 2019-10-16. Last modified 2026-06-17.