Report a vulnerability

Report security problems privately, through GitHub's private vulnerability reporting. Only the maintainers see a private advisory, and we disclose it together with you once a fix is out. Please do not open a public issue, pull request or discussion for a vulnerability.

Report a vulnerability on GitHub

What to include

• what is affected: the commit or build, the OS and the JDK;
• a description, with the files and lines involved if you know them;
• steps or a small proof of concept that reproduces it;
• the impact: who can do what to whom;
• a suggested fix, if you have one.

We aim to acknowledge a report within a week and to agree on a disclosure date with you.

Scope

Everything the repository adds to Ghidra, above all the session module: its daemon, the loopback socket and its token check, the endpoint and state files, the launcher ghidra_session.py, and the headless build files.

Working as designed

• Anyone who can read your state directory can read the endpoint token and drive the daemon with your rights. The endpoint file is owner-only and the socket binds loopback only; that is the boundary.
• script runs Java or Python with the daemon's rights. Containment protects other clients' view of a program, not the machine. It is not a sandbox.
• A program you import or analyse is parsed by Ghidra's loaders and analysers. Analyse untrusted binaries the way you would with Ghidra itself: in an environment you are prepared to lose.

Problems in Ghidra itself

Most of the code is upstream Ghidra. If the problem also happens with a Ghidra build from the upstream repository, report it to the Ghidra project as its security policy describes, and let us know privately so that we can pick up the fix.

The full policy is SECURITY.md in the repository. For how the daemon authenticates clients, see The shared daemon.