Vulnerability-Lookup

BDU:2025-13636

Vulnerability from fstec - Published: 04.06.2025

Title

Уязвимость интегрированной среды разработки (IDE) Unity Editor, связанная с использованием ненадёжного пути поиска, позволяющая нарушителю повысить свои привилегии

Description

Уязвимость интегрированной среды разработки (IDE) Unity Editor связана с использованием ненадёжного пути поиска. Эксплуатация уязвимости может позволить нарушителю повысить свои привилегии

Severity ?


                    
                      AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor

Unity Technologies

Software Name

Unity Editor

Software Version

до 6000.3.0b4 (Unity Editor), до 6000.2.6f2 (Unity Editor), до 6000.0.58f2 (Unity Editor), до 2022.3.67f2 (Unity Editor), до 2021.3.56f2 (Unity Editor)

Possible Mitigations

Использование рекомендаций производителя: https://unity.com/security/sept-2025-01

Reference

https://unity.com/security/sept-2025-01 https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/

CWE

CWE-426

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Unity Technologies",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 6000.3.0b4 (Unity Editor), \u0434\u043e 6000.2.6f2 (Unity Editor), \u0434\u043e 6000.0.58f2 (Unity Editor), \u0434\u043e 2022.3.67f2 (Unity Editor), \u0434\u043e 2021.3.56f2 (Unity Editor)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://unity.com/security/sept-2025-01",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "04.06.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "01.11.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "01.11.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-13636",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-59489",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Unity Editor",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Google Inc Android - , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux - , Microsoft Corp Windows - , Apple Inc. MacOS - ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 (IDE) Unity Editor, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u043f\u043e\u0438\u0441\u043a\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u043f\u043e\u0438\u0441\u043a\u0430 (CWE-426)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 (IDE) Unity Editor \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u043f\u043e\u0438\u0441\u043a\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://unity.com/security/sept-2025-01\nhttps://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-426",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,2)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,4)"
}

CVE-2025-59489 (GCVE-0-2025-59489)

Vulnerability from cvelistv5 – Published: 2025-10-03 00:00 – Updated: 2025-10-03 17:22

Summary

Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

mitre

References

URL

Tags

	https://unity.com/security#security-updates-and-patches
	https://unity.com/security/sept-2025-01
	https://flatt.tech/research/posts/arbitrary-code-…

Impacted products

	Vendor	Product	Version
	Unity3D	Unity Editor	Affected: 6000.3 , < 6000.3.0b4 (custom) Affected: 6000.2 , < 6000.2.6f2 (custom) Affected: 6000.0 LTS , < 6000.0.58f2 (custom) Affected: 2022.3 xLTS , < 2022.3.67f2 (custom) Affected: 2021.3 xLTS , < 2021.3.56f2 (custom) Affected: 6000.1 , < 6000.1.17f1 (custom) Affected: 2023.2 , < 2023.2.22f1 (custom) Affected: 2023.1 , < 2023.1.22f1 (custom) Affected: 2022.3 LTS , < 2022.3.62f2 (custom) Affected: 2022.2 , < 2022.2.23f1 (custom) Affected: 2022.1 , < 2022.1.25f1 (custom) Affected: 2021.3 LTS , < 2021.3.45f2 (custom) Affected: 2021.2 , < 2021.2.20f1 (custom) Affected: 2021.1 , < 2021.1.29f1 (custom) Affected: 2020.3 , < 2020.3.49f1 (custom) Affected: 2020.2 , < 2020.2.8f1 (custom) Affected: 2020.1 , < 2020.1.18f1 (custom) Affected: 2019.4 LTS , < 2019.4.41f1 (custom) Affected: 2019.3 , < 2019.3.17f1 (custom) Affected: 2019.2 , < 2019.2.23f1 (custom) Affected: 2017.1.2p4 , < 2019.1.15f1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-59489",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-03T13:54:27.467605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-426",
                "description": "CWE-426 Untrusted Search Path",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-03T13:56:31.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unity Editor",
          "vendor": "Unity3D",
          "versions": [
            {
              "lessThan": "6000.3.0b4",
              "status": "affected",
              "version": "6000.3",
              "versionType": "custom"
            },
            {
              "lessThan": "6000.2.6f2",
              "status": "affected",
              "version": "6000.2",
              "versionType": "custom"
            },
            {
              "lessThan": "6000.0.58f2",
              "status": "affected",
              "version": "6000.0 LTS",
              "versionType": "custom"
            },
            {
              "lessThan": "2022.3.67f2",
              "status": "affected",
              "version": "2022.3 xLTS",
              "versionType": "custom"
            },
            {
              "lessThan": "2021.3.56f2",
              "status": "affected",
              "version": "2021.3 xLTS",
              "versionType": "custom"
            },
            {
              "lessThan": "6000.1.17f1",
              "status": "affected",
              "version": "6000.1",
              "versionType": "custom"
            },
            {
              "lessThan": "2023.2.22f1",
              "status": "affected",
              "version": "2023.2",
              "versionType": "custom"
            },
            {
              "lessThan": "2023.1.22f1",
              "status": "affected",
              "version": "2023.1",
              "versionType": "custom"
            },
            {
              "lessThan": "2022.3.62f2",
              "status": "affected",
              "version": "2022.3 LTS",
              "versionType": "custom"
            },
            {
              "lessThan": "2022.2.23f1",
              "status": "affected",
              "version": "2022.2",
              "versionType": "custom"
            },
            {
              "lessThan": "2022.1.25f1",
              "status": "affected",
              "version": "2022.1",
              "versionType": "custom"
            },
            {
              "lessThan": "2021.3.45f2",
              "status": "affected",
              "version": "2021.3 LTS",
              "versionType": "custom"
            },
            {
              "lessThan": "2021.2.20f1",
              "status": "affected",
              "version": "2021.2",
              "versionType": "custom"
            },
            {
              "lessThan": "2021.1.29f1",
              "status": "affected",
              "version": "2021.1",
              "versionType": "custom"
            },
            {
              "lessThan": "2020.3.49f1",
              "status": "affected",
              "version": "2020.3",
              "versionType": "custom"
            },
            {
              "lessThan": "2020.2.8f1",
              "status": "affected",
              "version": "2020.2",
              "versionType": "custom"
            },
            {
              "lessThan": "2020.1.18f1",
              "status": "affected",
              "version": "2020.1",
              "versionType": "custom"
            },
            {
              "lessThan": "2019.4.41f1",
              "status": "affected",
              "version": "2019.4 LTS",
              "versionType": "custom"
            },
            {
              "lessThan": "2019.3.17f1",
              "status": "affected",
              "version": "2019.3",
              "versionType": "custom"
            },
            {
              "lessThan": "2019.2.23f1",
              "status": "affected",
              "version": "2019.2",
              "versionType": "custom"
            },
            {
              "lessThan": "2019.1.15f1",
              "status": "affected",
              "version": "2017.1.2p4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6000.3.0b4",
                  "versionStartIncluding": "6000.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6000.2.6f2",
                  "versionStartIncluding": "6000.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6000.0.58f2",
                  "versionStartIncluding": "6000.0 LTS",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2022.3.67f2",
                  "versionStartIncluding": "2022.3 xLTS",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2021.3.56f2",
                  "versionStartIncluding": "2021.3 xLTS",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6000.1.17f1",
                  "versionStartIncluding": "6000.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2023.2.22f1",
                  "versionStartIncluding": "2023.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2023.1.22f1",
                  "versionStartIncluding": "2023.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2022.3.62f2",
                  "versionStartIncluding": "2022.3 LTS",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2022.2.23f1",
                  "versionStartIncluding": "2022.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2022.1.25f1",
                  "versionStartIncluding": "2022.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2021.3.45f2",
                  "versionStartIncluding": "2021.3 LTS",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2021.2.20f1",
                  "versionStartIncluding": "2021.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2021.1.29f1",
                  "versionStartIncluding": "2021.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2020.3.49f1",
                  "versionStartIncluding": "2020.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2020.2.8f1",
                  "versionStartIncluding": "2020.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2020.1.18f1",
                  "versionStartIncluding": "2020.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2019.4.41f1",
                  "versionStartIncluding": "2019.4 LTS",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2019.3.17f1",
                  "versionStartIncluding": "2019.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2019.2.23f1",
                  "versionStartIncluding": "2019.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2019.1.15f1",
                  "versionStartIncluding": "2017.1.2p4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-03T17:22:11.001Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://unity.com/security#security-updates-and-patches"
        },
        {
          "url": "https://unity.com/security/sept-2025-01"
        },
        {
          "url": "https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-59489",
    "datePublished": "2025-10-03T00:00:00.000Z",
    "dateReserved": "2025-09-16T00:00:00.000Z",
    "dateUpdated": "2025-10-03T17:22:11.001Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2025-13636

CVE-2025-59489 (GCVE-0-2025-59489)

Tags

Sightings

Nomenclature