CVE-2025-59489: unity editor

csirt@kutim:~/threat-intel/cve/CVE-2025-59489

CVSS 7.4 · High EPSS 0,64%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada unity editor. Skor CVSS 3.1 7.4 (High) menurut mitre.org.

Deskripsi (NVD)

Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.

Rincian

Terbit di NVD: 3 Oktober 2025
Terakhir diubah: 8 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 7.4 (High), sumber mitre.org
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-426: Untrusted Search Path
EPSS (30 hari): 0,64% peluang dieksploitasi; lebih tinggi dari 49,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
unity	editor	Versi 2017.4 hingga 2018.4
unity	editor	Versi 2019.1 hingga sebelum 2019.1.15f1
unity	editor	Versi 2019.2 hingga sebelum 2019.2.23f1
unity	editor	Versi 2019.3 hingga 2019.3.17f1
unity	editor	Versi 2019.4 hingga sebelum 2019.4.41f1
unity	editor	Versi 2020.1 hingga sebelum 2020.1.18f1
unity	editor	Versi 2020.2 hingga sebelum 2020.2.8f1
unity	editor	Versi 2020.3 hingga sebelum 2020.3.49f1
unity	editor	Versi 2021.1 hingga sebelum 2021.1.29f1
unity	editor	Versi 2021.2 hingga sebelum 2021.2.20f1
unity	editor	Versi 2021.3 hingga sebelum 2021.3.45f2
unity	editor	Versi 2022.1 hingga sebelum 2022.1.25f1
unity	editor	Versi 2022.2 hingga sebelum 2022.2.23f1
unity	editor	Versi 2022.3 hingga sebelum 2022.3.62f2
unity	editor	Versi 2023.1 hingga sebelum 2023.1.22f1
unity	editor	Versi 2023.2 hingga sebelum 2023.2.22f1
unity	editor	Versi 6000.0 hingga sebelum 6000.0.58f2
unity	editor	Versi 6000.1 hingga sebelum 6000.1.17f1
unity	editor	Versi 6000.2 hingga sebelum 6000.2.6f2
unity	editor	Versi 6000.3 hingga sebelum 6000.3.0b4
unity	editor	Versi 2017.1.2p4+
unity	editor	Versi 2017.2.0p4+
unity	editor	Versi 2017.3.0b9+

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://unity.com/security/sept-2025-01 advisory vendor
https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/ exploit · advisory pihak ketiga
https://unity.com/security#security-updates-and-patches product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 12:28 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.