Read the docs
TI-2025-37031 Aliases CVE-2025-59489GHSA-427p-ppg4-cg5q

Untrusted search path in Unity3D Unity Editor

Priority HIGH 72CWE-88Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-88.

Summary

Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00644 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Unity Editor (Unity3D): 6000.3.0b4, 6000.2.6f2, 6000.0.58f2 +18

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Unity3DUnity Editor6000.3 to before 6000.3.0b4; 6000.2 to before 6000.2.6f2; 6000.0 LTS to before 6000.0.58f2; 2022.3 xLTS to before 2022.3.67f2; 2021.3 xLTS to before 2021.3.56f2; 6000.1 to before 6000.1.17f1; 2023.2 to before 2023.2.22f1; 2023.1 to before 2023.1.22f1; 2022.3 LTS to before 2022.3.62f2; 2022.2 to before 2022.2.23f1; 2022.1 to before 2022.1.25f1; 2021.3 LTS to before 2021.3.45f2; 2021.2 to before 2021.2.20f1; 2021.1 to before 2021.1.29f1; 2020.3 to before 2020.3.49f1; 2020.2 to before 2020.2.8f1; 2020.1 to before 2020.1.18f1; 2019.4 LTS to before 2019.4.41f1; 2019.3 to before 2019.3.17f1; 2019.2 to before 2019.2.23f1; 2017.1.2p4 to before 2019.1.15f16000.3.0b4, 6000.2.6f2, 6000.0.58f2, 2022.3.67f2, 2021.3.56f2, 6000.1.17f1, 2023.2.22f1, 2023.1.22f1, 2022.3.62f2, 2022.2.23f1, 2022.1.25f1, 2021.3.45f2, 2021.2.20f1, 2021.1.29f1, 2020.3.49f1, 2020.2.8f1, 2020.1.18f1, 2019.4.41f1, 2019.3.17f1, 2019.2.23f1, 2019.1.15f1Patch availableCNA
  • Unity Editor VendorUnity3D Affected 6000.3 to before 6000.3.0b4; 6000.2 to before 6000.2.6f2; 6000.0 LTS to before 6000.0.58f2; 2022.3 xLTS to before 2022.3.67f2; 2021.3 xLTS to before 2021.3.56f2; 6000.1 to before 6000.1.17f1; 2023.2 to before 2023.2.22f1; 2023.1 to before 2023.1.22f1; 2022.3 LTS to before 2022.3.62f2; 2022.2 to before 2022.2.23f1; 2022.1 to before 2022.1.25f1; 2021.3 LTS to before 2021.3.45f2; 2021.2 to before 2021.2.20f1; 2021.1 to before 2021.1.29f1; 2020.3 to before 2020.3.49f1; 2020.2 to before 2020.2.8f1; 2020.1 to before 2020.1.18f1; 2019.4 LTS to before 2019.4.41f1; 2019.3 to before 2019.3.17f1; 2019.2 to before 2019.2.23f1; 2017.1.2p4 to before 2019.1.15f1 Fixed in 6000.3.0b4, 6000.2.6f2, 6000.0.58f2, 2022.3.67f2, 2021.3.56f2, 6000.1.17f1, 2023.2.22f1, 2023.1.22f1, 2022.3.62f2, 2022.2.23f1, 2022.1.25f1, 2021.3.45f2, 2021.2.20f1, 2021.1.29f1, 2020.3.49f1, 2020.2.8f1, 2020.1.18f1, 2019.4.41f1, 2019.3.17f1, 2019.2.23f1, 2019.1.15f1 Patch available CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*2017.4 – 2018.4; 2019.1 to before 2019.1.15f1; 2019.2 to before 2019.2.23f1; 2019.3 – 2019.3.17f1VulnerableUnity
cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*2019.4 to before 2019.4.41f1VulnerableUnity
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*2020.1 to before 2020.1.18f1; 2020.2 to before 2020.2.8f1; 2020.3 to before 2020.3.49f1; 2021.1 to before 2021.1.29f1; 2021.2 to before 2021.2.20f1VulnerableUnity
cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*2021.3 to before 2021.3.45f2VulnerableUnity
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*2022.1 to before 2022.1.25f1; 2022.2 to before 2022.2.23f1VulnerableUnity
cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:*2022.3 to before 2022.3.62f2; 2023.1 to before 2023.1.22f1; 2023.2 to before 2023.2.22f1; 6000.0 to before 6000.0.58f2VulnerableUnity
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*6000.1 to before 6000.1.17f1; 6000.2 to before 6000.2.6f2; 6000.3 to before 6000.3.0b4VulnerableUnity
cpe:2.3:a:unity:editor:2017.1.2p4\+:*:*:*:-:*:*:*2017.1.2p4+VulnerableUnity
cpe:2.3:a:unity:editor:2017.2.0p4\+:*:*:*:-:*:*:*2017.2.0p4+VulnerableUnity
cpe:2.3:a:unity:editor:2017.3.0b9\+:*:*:*:-:*:*:*2017.3.0b9+VulnerableUnity
  • cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:* Versions 2017.4 – 2018.4; 2019.1 to before 2019.1.15f1; 2019.2 to before 2019.2.23f1; 2019.3 – 2019.3.17f1 Vulnerable ·Unity
  • cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:* Versions 2019.4 to before 2019.4.41f1 Vulnerable ·Unity
  • cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:* Versions 2020.1 to before 2020.1.18f1; 2020.2 to before 2020.2.8f1; 2020.3 to before 2020.3.49f1; 2021.1 to before 2021.1.29f1; 2021.2 to before 2021.2.20f1 Vulnerable ·Unity
  • cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:* Versions 2021.3 to before 2021.3.45f2 Vulnerable ·Unity
  • cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:* Versions 2022.1 to before 2022.1.25f1; 2022.2 to before 2022.2.23f1 Vulnerable ·Unity
  • cpe:2.3:a:unity:editor:*:*:*:*:lts:*:*:* Versions 2022.3 to before 2022.3.62f2; 2023.1 to before 2023.1.22f1; 2023.2 to before 2023.2.22f1; 6000.0 to before 6000.0.58f2 Vulnerable ·Unity
  • cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:* Versions 6000.1 to before 6000.1.17f1; 6000.2 to before 6000.2.6f2; 6000.3 to before 6000.3.0b4 Vulnerable ·Unity
  • cpe:2.3:a:unity:editor:2017.1.2p4\+:*:*:*:-:*:*:* Versions 2017.1.2p4+ Vulnerable ·Unity
  • cpe:2.3:a:unity:editor:2017.2.0p4\+:*:*:*:-:*:*:* Versions 2017.2.0p4+ Vulnerable ·Unity
  • cpe:2.3:a:unity:editor:2017.3.0b9\+:*:*:*:-:*:*:* Versions 2017.3.0b9+ Vulnerable ·Unity
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*not specified by NVDRunning onGoogle
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
  • cpe:2.3:o:google:android:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Google
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA Unity Editor (Unity3D) Fixed in 6000.3.0b4, 6000.2.6f2, 6000.0.58f2, 2022.3.67f2, 2021.3.56f2, 6000.1.17f1, 2023.2.22f1, 2023.1.22f1, 2022.3.62f2, 2022.2.23f1, 2022.1.25f1, 2021.3.45f2, 2021.2.20f1, 2021.1.29f1, 2020.3.49f1, 2020.2.8f1, 2020.1.18f1, 2019.4.41f1, 2019.3.17f1, 2019.2.23f1, 2019.1.15f1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59489
  2. 2026-10-03 Alias added: GHSA-427p-ppg4-cg5q
  3. 2026-10-21 EPSS moved to the 50th–90th percentile

References

Exploit 1

Advisory 1

Other 1

  • TI-2017-09584 A Remote Code Execution vulnerability was identified in all Windows versions of Unity… CVSS 3.0CRITICAL 9.8
  • TI-2019-06655 The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code. CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences