I don't understand the threat model of this for most Unity games on PC, it doesn't seem like there's anything you could do by running arbitrary code inside the Unity player that you couldn't already run on your PC directly or access via the process's memory, etc?
Arbitrary code execution in Unity Runtime
21–30 of 33 posts
Re: Arbitrary code execution in Unity Runtime
#22I'll just leave this here: https://godotengine.org/
Is it known to be free from arbitrary code execution vulns? Or is it known to also contain ACEs? What's the relevance to the post?
Godot has a known issue where the built in deserialization can lead to arbitrary code execution. E.g. a save file could be modified to execute any script when it's deserialized.
Re: Arbitrary code execution in Unity Runtime
#23Ah so that email was legit
I got it like 4 times, they really really wanted to us to be aware.
Re: Arbitrary code execution in Unity Runtime
#24Earlier quoted context omitted.
Is it known to be free from arbitrary code execution vulns? Or is it known to also contain ACEs? What's the relevance to the post?
It's opensource, so people would likely have caught this issue. It's opensource, so they can't just make some foolish, arbitrary licensing change to extort money from customers. It's opensource, so it is going to be a better engine in the long run. Unity had a niche, their greedy execs killed that and Godot is one of the beneficiaries of that.
"It's opensource, so people would likely have caught this issue."
Lol, practically every CVE is on code you can read.
"It's opensource, so it is going to be a better engine in the long run." Citation needed.
Re: Arbitrary code execution in Unity Runtime
#25This is somewhat unsurprising - gaming software will doubtless cut corners on security-adjacent tooling (valgrind, etc) in order to ship faster. It's also somewhat irrelevant unless there's a remote chain. The Android Browser idea is interesting but is this actually a likely scenario?
I'd say that most lines of business cuts as many or even more corners until they grow large or have other security interests, gamedevs are fairly prideful of their work in comparison to many other industries.
In this case however I'm gathering that this is an engine level issue, in general Unity hasn't been a huge target since most game-code is run under C# (even if people might resort to unsafe for some things) and has basic memory safety from the language. It's a bad oversight in this case though.
Re: Arbitrary code execution in Unity Runtime
#26> This vulnerability allows malicious intents to control command line arguments passed to Unity applications, enabling attackers to load arbitrary shared libraries (.so files) and execute malicious code, depending on the platform. Aren't intents an Android-only thing? I'm not sure adding "depending on the platform" makes sense when the exploit only works on a single platform.
The biggest impact is for Android. The official advisory from Unity https://unity.com/security/sept-2025-01 lists that for desktop platforms it's more of privilege escalation instead of code execution.
On windows if the game has been registered as custom URL scheme handler it opens ways for triggering it without ability to pass custom CLI arguments.
On macOS as part of application signing macOS apps also contain permission manifest. So in theory if a user runs a malicious app (which for some reason is properly signed but with limited permissions) it could leverage a vulnerable game to run in the context of slightly more permissions but still as the same user.
On Linux in most cases anyone able to pass cli arguments could also run code directly with same privileges. I guess if the game executable was marked as setuid. That seems unlikely.
Re: Arbitrary code execution in Unity Runtime
#27Earlier quoted context omitted.
It's opensource, so people would likely have caught this issue. It's opensource, so they can't just make some foolish, arbitrary licensing change to extort money from customers. It's opensource, so it is going to be a better engine in the long run. Unity had a niche, their greedy execs killed that and Godot is one of the beneficiaries of that.
"It's opensource, so people would likely have caught this issue." Lol, practically every CVE is on code you can read. "It's opensource, so it is going to be a better engine in the long run." Citation needed.
> "practically every CVE is on code you can read."
This is probably true due to a sort of survivorship bias. code you can read is much easier to analyze and test and report. Closed source internal code has a lot of security by obscurity built into it. Not to dismiss security by obscurity, I am sure it keeps an absolute frightening amount of code safe.
Re: Arbitrary code execution in Unity Runtime
#28[deleted]
Re: Arbitrary code execution in Unity Runtime
#29How about WebGL? Should I avoid playing unity games in the browser from now on?
I am baffled how they don't mention this at all.
There is https://discussions.unity.com/t/webgl-project-running-only-i... but the response is laughable.
Re: Arbitrary code execution in Unity Runtime
#30How about WebGL? Should I avoid playing unity games in the browser from now on? I am baffled how they don't mention this at all. There is https://discussions.unity.com/t/webgl-project-running-only-i... but the response is laughable.
One method requires a command line argument and the other is largely an Android thing, so WebGL is safe. But in any case, an HTML5 game wouldn't be an issue, it couldn't do anything malicious that websites in general can't do.