@@ -1,5 +1,39 @@
 # Changelog
 
+## 1.3.3
+
+### CRITICAL security: Ghidra >= 12.1 + optional sandboxed engine
+
+The bundled/default Ghidra was 12.0.4, which is vulnerable to multiple high-severity
+CVEs that a **crafted binary can trigger during import or decompilation** - exactly the
+input RawView is built to analyze:
+
+- **CVE-2026-52757** (CVSS 7.8) - heap use-after-free in the decompiler's
+  `HighVariable::merge()`, triggerable by a crafted binary.
+- **CVE-2026-52752** (CVSS 7.8) - SleighBuilder use-after-free, triggerable by
+  decompiling a malicious binary.
+- **CVE-2026-52750** (CVSS 7.8) - Swift demangler arbitrary code execution via a
+  malicious Ghidra project.
+- **CVE-2026-52753** (CVSS 5.5) - Mach-O export-trie out-of-memory / JVM crash.
+
+All are fixed in Ghidra 12.1. This release:
+
+- **Bumps the default/bundled Ghidra to 12.1.3** (`GHIDRA_BUNDLE_URL`), the latest
+  patched public release at release time. Existing installs should re-point
+  `GHIDRA_INSTALL_DIR` / `GHIDRA_BUNDLE_URL` at a 12.1+ build and recompile the Java
+  bridge (`python -m rawview.scripts.compile_java`).
+- **Adds `RAWVIEW_SANDBOX=bwrap` (Linux).** The Ghidra JVM now runs inside a
+  [bubblewrap](https://github.com/containers/bubblewrap) mount-namespace sandbox:
+  read-only root, `/home` `/root` `/media` `/mnt` `/srv` `/var` stripped to tmpfs, the
+  toolchain re-bound read-only, and the RawView project dir the only writable host tree.
+  A compromise of the Ghidra process (e.g. a future importer/decompiler bug) **cannot
+  read your `~/.ssh`, wallets, browsers, or other host files**. The Python/Qt app stays
+  user-mode on the host. Enabled by default on Linux when `bwrap` is installed; use
+  `RAWVIEW_SANDBOX=none` to disable.
+
+**Recommended:** all users analyzing untrusted/hostile binaries should upgrade to this
+release and re-point at Ghidra 12.1+ as soon as possible.
+
 ## 1.3.2
 
 ### Fixes a broken 1.3.1
 
@@ -105,6 +105,30 @@ Writes `RawView-source-<version>.zip` on the parent of this repo folder.
 
 Do **not** commit API keys, tokens, or `rawview.env` from your machine. Settings normally live under `%LOCALAPPDATA%\RawView\`. `.gitignore` excludes common secret filenames and large local Ghidra/JDK trees if they are ever copied next to the clone.
 
+### Ghidra version (CVE fixes)
+
+RawView analyzes untrusted binaries **through Ghidra's importers and native decompiler**. Ghidra releases before **12.1** have known high-severity vulnerabilities that a crafted binary can trigger during import or decompilation:
+
+- **CVE-2026-52757** (CVSS 7.8) — heap use-after-free in the decompiler's `HighVariable::merge()`, triggerable by a crafted binary.
+- **CVE-2026-52752** (CVSS 7.8) — SleighBuilder use-after-free, triggerable by decompiling a malicious binary.
+- **CVE-2026-52750** (CVSS 7.8) — Swift demangler arbitrary code execution via a malicious Ghidra project.
+- **CVE-2026-52753** (CVSS 5.5) — Mach-O export-trie out-of-memory (JVM crash).
+
+RawView requires **Ghidra ≥ 12.1** to analyze hostile samples. The bundled default and `GHIDRA_BUNDLE_URL` point at the latest public release (auto-resolved at download time).
+
+### Sandboxed Ghidra engine (optional, Linux)
+
+On Linux with [bubblewrap](https://github.com/containers/bubblewrap), RawView can run the **entire Ghidra JVM (parsers + native decompiler) inside a mount-namespace sandbox** while the Python/Qt app stays user-mode on the host. `RAWVIEW_SANDBOX=bwrap` (default on Linux when `bwrap` is installed) wraps the JVM launch:
+
+- Read-only root, sensitive trees stripped to tmpfs (`/home`, `/root`, `/media`, `/mnt`, `/srv`, `/var`).
+- The toolchain (Ghidra, JDK, bridge classes, py4j jar) is re-bound read-only at its real path.
+- The **project dir** is the only writable host tree.
+- Py4J stays loopback-only; network namespace is shared.
+
+This means a compromise of the Ghidra process — e.g. an unknown importer/decompiler bug in the parser — **cannot read your `~/.ssh`, wallets, browsers, or other host files**. Set `RAWVIEW_SANDBOX=none` to disable, or `bwrap` to enable. Windows always uses `none` (no bwrap).
+
+> Best practice: for highly hostile samples, still consider a dedicated analysis **VM**; the sandbox removes file access, but shared-kernel+network residual risk remains.
+
 ## License
 
 [GNU General Public License v3.0](LICENSE).
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rawview"
-version = "1.3.2"
+version = "1.3.3"
 description = "Qt front-end and agent for Ghidra reverse engineering"
 readme = "README.md"
 requires-python = ">=3.11"
 
@@ -4,4 +4,4 @@
 See LICENSE at the repository root for the full GPLv3 text.
 """
 
-__version__ = "1.3.2"
+__version__ = "1.3.3"
@@ -92,8 +92,18 @@ class Settings(BaseSettings):
         description="Override URL for the Ghidra public zip download.",
     )
 
+    rawview_sandbox: str = Field(default="bwrap", validation_alias="RAWVIEW_SANDBOX")
+
     rawview_auto_start_bridge: bool = Field(default=True, validation_alias="RAWVIEW_AUTO_START_BRIDGE")
 
+    @field_validator("rawview_sandbox", mode="before")
+    @classmethod
+    def _normalize_sandbox(cls, v: object) -> object:
+        if v is None:
+            return "bwrap"
+        val = str(v).strip().lower()
+        return val if val in ("none", "bwrap") else "bwrap"
+
     @field_validator("ghidra_install_dir", mode="before")
     @classmethod
     def _empty_ghidra_dir_none(cls, v: object) -> object:
 
@@ -121,6 +121,97 @@ def _windows_java_cmdline_limit() -> int:
     return 24_000
 
 
+def _classpath_items(java_args: list[str]) -> list[str]:
+    """Extract the classpath entries from a ``-cp`` java argument list."""
+    try:
+        i = java_args.index("-cp")
+    except ValueError:
+        return []
+    cp = java_args[i + 1]
+    sep = ";" if sys.platform == "win32" else ":"
+    return [c for c in cp.split(sep) if c]
+
+
+def _build_bwrap_mounts_and_rewrite(
+    *,
+    java_exe: Path,
+    ghidra_install: Path,
+    classes_root: Path,
+    py4j_jar: Path,
+    project_dir: Path,
+    java_args: list[str],
+) -> tuple[list[str], list[str]]:
+    """
+    Build bwrap arguments that sandbox the Ghidra JVM using a read-only root + overlay layout.
+
+    Layout:
+      --ro-bind / /   read-only whole root (so the JVM's arbitrary absolute toolchain paths resolve)
+      --tmpfs over user/sensitive trees to strip real data:
+          /home, /root, /media, /mnt, /srv, /var
+      --ro-bind back the exact toolchain dirs that must exist under /home (Ghidra install,
+          JDK, bridge classes, py4j jar) at their real absolute guest paths.
+      --bind  <project_dir> <same>   the ONLY writable host tree (analyzed programs / RE sessions).
+      --tmpfs /tmp + HOME=/tmp        sandbox-local temp space.
+
+    The project dir keeps its real host absolute path so Ghidra-returned paths round-trip to RawView.
+    Py4J is loopback-only, so the network namespace is shared (:func:`_classpath` uses loopback).
+    With /home + /root stripped to tmpfs and only the toolchain re-bound, a compromise of the Ghidra
+    process cannot read the user's wallets, .ssh, browsers, or other data.
+    """
+    jdk_root = java_exe.resolve().parent.parent
+
+    bwrap_args = [
+        "bwrap",
+        "--unshare-pid",
+        "--unshare-uts",
+        "--unshare-ipc",
+        "--unshare-user",
+        "--die-with-parent",
+        "--share-net",
+        "--ro-bind",
+        "/",
+        "/",
+        "--tmpfs",
+        "/home",
+        "--tmpfs",
+        "/root",
+        "--tmpfs",
+        "/media",
+        "--tmpfs",
+        "/mnt",
+        "--tmpfs",
+        "/srv",
+        "--tmpfs",
+        "/var",
+        "--proc",
+        "/proc",
+        "--dev",
+        "/dev",
+        "--ro-bind",
+        "/sys",
+        "/sys",
+        "--tmpfs",
+        "/tmp",
+    ]
+
+    toolchain_roots: list[Path] = [
+        ghidra_install.resolve(),
+        jdk_root,
+        classes_root.resolve(),
+        py4j_jar.resolve().parent,
+    ]
+    for root in sorted(toolchain_roots, key=lambda p: -len(p.parts)):
+        bwrap_args += ["--ro-bind", str(root), str(root)]
+    proj = project_dir.resolve()
+    bwrap_args += ["--bind", str(proj), str(proj)]
+    bwrap_args += ["--setenv", "HOME", "/tmp"]
+    bwrap_args += ["--chdir", str(proj)]
+
+    # The toolchain stays at its real host paths, so java_args need no path rewriting.
+    bwrap_args.append(str(java_exe.resolve()))
+    return bwrap_args, java_args
+
+
 def _pick_free_loopback_tcp_port(preferred: int, *, span: int = 256) -> int:
     """
     Return a port on 127.0.0.1 that is free at probe time, scanning upward from ``preferred``.
@@ -176,6 +267,7 @@ class GhidraBridgeController:
     project_dir: Path
     java_classes_dir: Path | None
     raw_classpath: str | None
+    sandbox: str = "none"
     startup_timeout_s: float = 120.0
     # Wait for in-flight RPC before tearing down Py4J (auto-analysis can run a long time).
     # Still bounded so Quit does not hang forever on a stuck JVM.
@@ -301,7 +393,32 @@ def _java_command(self, java_args: list[str]) -> tuple[list[str], Path | None]:
                 _write_java_argfile(argf, java_args)
                 logger.info("Using Java @argfile (command line length ~%s): %s", approx, argf)
                 return [exe, f"@{argf.resolve()}"], argf
-        return [exe] + java_args, None
+        plain = [exe] + java_args
+        if self.sandbox == "bwrap" and not sys.platform.startswith("win"):
+            try:
+                classes_root = self.java_classes_dir
+                if classes_root is None:
+                    classes_root = _packaged_bridge_classes_dir()
+                if classes_root is None:
+                    raise FileNotFoundError("cannot resolve Java bridge classes dir for sandbox mount")
+                bwrap_args, rewritten = _build_bwrap_mounts_and_rewrite(
+                    java_exe=Path(exe),
+                    ghidra_install=self.ghidra_install_dir,
+                    classes_root=classes_root,
+                    py4j_jar=_find_py4j_jar(),
+                    project_dir=self.project_dir,
+                    java_args=java_args,
+                )
+                cmd = bwrap_args + rewritten
+                logger.info(
+                    "Running Ghidra JVM inside bubblewrap sandbox (%d ro-binds, project rw): %s",
+                    bwrap_args.count("--ro-bind"),
+                    " ".join(cmd) [:240],
+                )
+                return cmd, None
+            except Exception:
+                logger.exception("bwrap sandbox build failed; falling back to unsandboxed JVM")
+        return plain, None
 
     def _spawn_and_connect(self) -> None:
         """Start JVM + Py4J, retrying if the listen port is still occupied (stale process / race)."""
 
@@ -30,10 +30,14 @@ def _ssl_context() -> ssl.SSLContext:
 
 
 # Official NSA Ghidra release zip (must match a real GitHub release asset name).
-# Resolved from https://api.github.com/repos/NationalSecurityAgency/ghidra/releases/latest
+# Security: 12.0.4 and earlier are vulnerable to multiple Ghidra CVEs fixed in 12.1+
+# (decompiler heap-UAF CVE-2026-52757, SleighBuilder UAF CVE-2026-52752, Swift demangler
+# arbitrary code execution CVE-2026-52750, Mach-O export-trie OOM CVE-2026-52753).
+# RawView requires >= 12.1 for parsed-malware analysis. Auto-resolution via
+# resolve_latest_ghidra_public_zip_url() picks the newest GitHub PUBLIC release.
 DEFAULT_GHIDRA_ZIP_URL = (
     "https://github.com/NationalSecurityAgency/ghidra/releases/download/"
-    "Ghidra_12.0.4_build/ghidra_12.0.4_PUBLIC_20260303.zip"
+    "Ghidra_12.1.3_build/ghidra_12.1.3_PUBLIC_20260817.zip"
 )
 
 
 
@@ -199,6 +199,7 @@ def _ensure_bridge(self) -> None:
             project_dir=self.settings.rawview_project_dir,
             java_classes_dir=self.settings.rawview_java_classes_dir,
             raw_classpath=self.settings.rawview_java_classpath,
+            sandbox=self.settings.rawview_sandbox,
         )
         self.status_message.emit("Starting Ghidra JVM...")
         self.bridge_state_changed.emit(BridgeState.STARTING.value)
 
@@ -9,17 +9,15 @@
 def main() -> int:
     root = Path(__file__).resolve().parents[2]
     sys.path.insert(0, str(root))
+    _default_ghidra_versions = ("ghidra_12.1.3_PUBLIC", "ghidra_12.0.4_PUBLIC", "ghidra_11.4.3_PUBLIC")
     if sys.platform == "win32":
-        _default_ghidra = str(
-            Path(os.environ.get("LOCALAPPDATA", os.path.expanduser("~")))
-            / "RawView" / "ghidra_bundle" / "ghidra_extract" / "ghidra_12.0.4_PUBLIC"
-        )
+        base = Path(os.environ.get("LOCALAPPDATA", os.path.expanduser("~")))
     else:
-        _default_ghidra = str(
-            Path(os.environ.get("XDG_DATA_HOME", os.path.expanduser("~/.local/share")))
-            / "RawView" / "ghidra_bundle" / "ghidra_extract" / "ghidra_12.0.4_PUBLIC"
-        )
-    os.environ.setdefault("GHIDRA_INSTALL_DIR", _default_ghidra)
+        base = Path(os.environ.get("XDG_DATA_HOME", os.path.expanduser("~/.local/share")))
+    rpa = base / "RawView" / "ghidra_bundle" / "ghidra_extract"
+    cand = next((rpa / v for v in _default_ghidra_versions if (rpa / v).is_dir()), None)
+    if cand is not None:
+        os.environ.setdefault("GHIDRA_INSTALL_DIR", str(cand))
 
     from rawview.config import load_settings
     from rawview.ghidra.api import GhidraAPI
@@ -41,6 +39,7 @@ def main() -> int:
         project_dir=s.rawview_project_dir,
         java_classes_dir=jcd,
         raw_classpath=s.rawview_java_classpath,
+        sandbox=s.rawview_sandbox,
     )
     api = GhidraAPI(bridge=bridge)
     print("starting JVM…", flush=True)
Original file line number	Diff line number	Diff line change
`@@ -199,6 +199,7 @@ def _ensure_bridge(self) -> None:`
`199`	`199`	`project_dir=self.settings.rawview_project_dir,`
`200`	`200`	`java_classes_dir=self.settings.rawview_java_classes_dir,`
`201`	`201`	`raw_classpath=self.settings.rawview_java_classpath,`
	`202`	`+ sandbox=self.settings.rawview_sandbox,`
`202`	`203`	`)`
`203`	`204`	`self.status_message.emit("Starting Ghidra JVM...")`
`204`	`205`	`self.bridge_state_changed.emit(BridgeState.STARTING.value)`