Vulnerability details
CVE-2025-59489
Unity3D Unity Editor
CVSS 3.1
7.4High
Official description
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.4High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 7.4High | 3.1 | CVEProject cvelistV5 (CNA) (mitre) | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Unity3D | Unity Editor | 2017.1.2p4 ≤ v < 2019.1.15f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2019.2 ≤ v < 2019.2.23f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2019.3 ≤ v < 2019.3.17f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2019.4 LTS ≤ v < 2019.4.41f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2020.1 ≤ v < 2020.1.18f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2020.2 ≤ v < 2020.2.8f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2020.3 ≤ v < 2020.3.49f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2021.1 ≤ v < 2021.1.29f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2021.2 ≤ v < 2021.2.20f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2021.3 LTS ≤ v < 2021.3.45f2 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2021.3 xLTS ≤ v < 2021.3.56f2 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2022.1 ≤ v < 2022.1.25f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2022.2 ≤ v < 2022.2.23f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2022.3 LTS ≤ v < 2022.3.62f2 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2022.3 xLTS ≤ v < 2022.3.67f2 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2023.1 ≤ v < 2023.1.22f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 2023.2 ≤ v < 2023.2.22f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 6000.0 LTS ≤ v < 6000.0.58f2 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 6000.1 ≤ v < 6000.1.17f1 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 6000.2 ≤ v < 6000.2.6f2 | CVEProject cvelistV5 (CNA) |
| Unity3D | Unity Editor | 6000.3 ≤ v < 6000.3.0b4 | CVEProject cvelistV5 (CNA) |
References and advisories
3
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-10-03
- Last updated
- 2025-10-03
- State
- Published
- Assigner (CNA)
- mitre
Exploit prediction (EPSS)
0.64%
Probability of exploitation in 30 days
51.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
- CWE-426Untrusted Search Path