CVE-2025-59489 Code injection in Unity Editor
Attackers can execute arbitrary code and steal data by exploiting argument injection in Unity Runtime, requiring developers to rebuild affected applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59489?
CVE-2025-59489 is a high-severity code injection vulnerability in Unity3D Unity Editor, published on 3 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.
Which versions are affected by CVE-2025-59489?
It affects 1 product.
Products include Unity Editor.
How do I fix CVE-2025-59489?
No fix has been published for CVE-2025-59489 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-59489 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59489 exists.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as GHSA-427p-ppg4-cg5q.