Description
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.
Problem types
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Product status
6000.3 before 6000.3.0b4
6000.2 before 6000.2.6f2
6000.0 LTS before 6000.0.58f2
2022.3 xLTS before 2022.3.67f2
2021.3 xLTS before 2021.3.56f2
6000.1 before 6000.1.17f1
2023.2 before 2023.2.22f1
2023.1 before 2023.1.22f1
2022.3 LTS before 2022.3.62f2
2022.2 before 2022.2.23f1
2022.1 before 2022.1.25f1
2021.3 LTS before 2021.3.45f2
2021.2 before 2021.2.20f1
2021.1 before 2021.1.29f1
2020.3 before 2020.3.49f1
2020.2 before 2020.2.8f1
2020.1 before 2020.1.18f1
2019.4 LTS before 2019.4.41f1
2019.3 before 2019.3.17f1
2019.2 before 2019.2.23f1
2017.1.2p4 before 2019.1.15f1
References
unity.com/security/sept-2025-01
flatt.tech/...sts/arbitrary-code-execution-in-unity-runtime/
