CVE-2023-22671: Nsa Ghidra

Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days.

Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with untrusted input.

Affected products

• Nsa Ghidra: up to and including 10.2.2

Published 2023-01-06. Last modified 2026-06-17.