Yesterday evening we received report of a remote code execution (RCE) exploit in a malicious server’s workshop mod. As a precaution, we temporarily disabled all Internet server listings while we prepared and released this patch. At this time, we believe the impact was limited to a single small server.

Our sincere thanks to celeb for reporting the exploit, to Jdance for creating a proof-of-concept test case (initially reported through the community Discord), and to Daniel Willett for running a scan of the past month of workshop uploads to check whether this exploit had been used anywhere else (fortunately, it was not)!

Fixed

• Prevent loading components with UnityEvents connected to static methods. These could be exploited to call restricted methods such as Application.OpenURL. (By default, the game filters third-party URLs.)

Edit: another patch, 3.26.3.6, has been released to fix an error when a component is missing its script during event validation, and to ignore events that haven’t been configured.