Yesterday evening we received report of a remote code execution (RCE) exploit in a malicious server's workshop mod. As a precaution, we temporarily disabled all Internet server listings while we prepared and released this patch. At this time, we believe the impact was limited to a single small server.

Our sincere thanks to celeb for reporting the exploit, to Jdance for creating a proof-of-concept test case (initially reported through the community Discord), and to Daniel Willett for running a scan of the past month of workshop uploads to check whether this exploit had been used anywhere else (fortunately, it was not)!

Fixed

• Prevent loading components with UnityEvents connected to static methods. These could be exploited to call restricted methods such as Application.OpenURL. (By default, the game filters third-party URLs.)

Edit: another patch, 3.26.3.6, has been released to fix an error when a component is missing its script during event validation, and to ignore events that haven't been configured.

Mods with "missing Item GameObject" (or similar) errors unfortunately require an update from the mod creator. Until then, certain custom items and objects may be missing from levels and servers.

In the cases we've reviewed, the issue was event-related components referencing a missing target object. For example, an event might be configured to trigger a particle system, but if the particle system was later removed without updating the event, the event is left pointing to an object that no longer exists.

Unfortunately, code-wise this is indistinguishable from an attempt to exploit the vulnerability, so it must be blocked.

For modders: we recommend checking the error log file. Above the missing GameObject warning should be a message with the precise component and event causing the issue.

Unturned's source code and project files are now freely available! Whether you have a new feature or total conversion in mind, the sky's the limit:

Browse the repository on GitHub[github.com]

Shown above: Playing Unturned's Russia map from within the Unity scene editor.

Unturned's greatest strength has always been its community. We're deeply grateful for the passion, creativity, and support you've shown over the years. We're proud to place the future of the game in your hands, and excited to see what you'll build next!

Frequently Asked Questions[docs.smartlydressedgames.com]

Source Code Demo: Adding a Heat-Seeking Missile on YouTube

Unturned's Modding Documentation[docs.smartlydressedgames.com]