Open-Source Security Research

Ghidra v12.0.4

Kuzushi Security's automated scan of NSA's Ghidra reverse-engineering framework uncovered 92 verified findings — including 4 critical SQL injection and remote code execution vectors in the BSim and TraceRMI subsystems — demonstrating how agentic scanning strategies surface architectural weaknesses that traditional SAST tools miss.

Scanned Apr 2, 2026·2M+ lines·11 scanners·8m 42s·Source →
92
Verified Findings
41
Critical + High
12
Threats Modeled
TraceRMI uses a plain unauthenticated TCP ServerSocket (no TLS, no auth) — a fundamental architectural gap that affects spoofing, tampering, and repudiation categories simultaneously.
Top Structural Weakness

Key Findings

92 findings across 54 files using 11 scannersscannerOne analysis engine inside Kuzushi. A single scan runs many scanners in parallel (Semgrep, CodeQL, AI Threat Hunting, etc.) and merges results by fingerprint.. 86 confirmed true positives (93% precision).

criticalseverityHow bad a single finding is, on a 4-point scale (critical / high / medium / low). A property of one code-level finding — not the threat model.Randori Threat Modeling

SQL Injection via Unchecked DB Name in BSim PostgreSQL Database Drop

SQL Injection via Unchecked DB Name in BSim PostgreSQL Database Drop: PostgresFunctionDatabase concatenates the BSim server's database name directly into a SQL string used to check database existence and then into a DROP DATABASE statement. A server-info object whose getDBName() returns a crafted string (e.g., containing a SQL comment or UNION clause) can lead to injection. The DROP DATABASE path is particularly dangerous because it is destructive and bypasses the BSim table-check guard via an injection that satisfies the guard condition.

criticalRandori Threat Modeling

SQL Injection via LSH Vector saveSQL() in BSim Vector Insertion

SQL Injection via LSH Vector saveSQL() in BSim Vector Insertion: The storeSignatureRecord() method in PostgresFunctionDatabase constructs a SQL function call by directly interpolating the output of LSHVector.saveSQL() into the query string. If saveSQL() produces output that contains single-quote characters (due to a crafted binary whose analysis generates unusual feature vectors), this string would be concatenated unescaped into the SQL, potentially allowing second-order SQL injection.

criticalRandori Threat Modeling

Malicious Ghidra Script in Shared Repository Achieves Analyst Workstation Code Execution

Malicious Ghidra Script in Shared Repository Achieves Analyst Workstation Code Execution: Ghidra scripts (Jython, Java, JShell, PyGhidra) execute in the same OS process as the analyst without sandboxing. If an attacker commits a malicious script to a shared GhidraServer repository, any analyst who opens that project and runs (or is auto-triggered to run) the script will execute attacker-controlled code with their OS credentials. Scripts have full access to the Java runtime, OS APIs, and the local file system.

criticalRandori Threat Modeling

TraceRMI Session Spoofing Tampers with Live Debugging State (Repudiation)

TraceRMI Session Spoofing Tampers with Live Debugging State (Repudiation): Because TraceRMI has no authentication, there is no binding between a debug session and a verified identity. An analyst cannot prove which debug agent (or whether a legitimate agent) injected specific memory or register values into a trace session. If the trace data is used as evidence in a forensic investigation or shared as a finding, an attacker could have silently corrupted it without any audit trail, and the analyst cannot demonstrate the integrity of the trace.

highDangerous API Detector

Arbitrary Binary Execution via JAAS Config

`Runtime.getRuntime().exec(cmdArray)` executes an operator-configured binary path (PROGRAM) together with operator-configured arguments (ARG_00…ARG_N) read from the JAAS config file. If the JAAS config file has insecure permissions or is attacker-supplied (e.g., via `-jaas <path>` argument), an attacker can specify any executable on the filesystem. [Runtime.getRuntime().exec(cmdArray)]

Want this level of analysis on your codebase?

Connect your GitHub and get continuous scanning, AI triage, threat modeling, and expert verification — all managed.

Book a Free Pilot ReviewView Pricing