CVE-2026-56137: RPG MAKER MV/MZ OS Command Injection via Save Files

Technical summary

CVE-2026-56137 is an OS command injection vulnerability (CWE-78) in RPG MAKER MV and MZ. The vulnerability exists in the save-file loading mechanism, which fails to properly sanitize user-supplied input before passing it to OS command execution routines. An attacker can craft a malicious save file containing shell metacharacters or command sequences that bypass input validation. When a user loads the compromised save file, the unsanitized input is executed with the privileges of the running application, allowing arbitrary command execution on the local system. The CVSS 3.0 score of 7.8 (HIGH) reflects the high confidentiality, integrity, and availability impact, though the attack requires local access and user interaction.

Business impact

Game developers and studios using RPG MAKER MV or MZ face direct risk to development infrastructure. A compromised developer machine can lead to theft of source code, insertion of malware into shipped games, credential theft, or lateral movement into internal networks. The attack surface is particularly concerning for independent developers who may receive game mods, assets, or save files from untrusted community members. Organizations shipping games built with these engines should consider the supply-chain implications: if a developer's machine is compromised during development, the final game distribution could be affected.

Affected systems

The vulnerability affects RPG MAKER MV and RPG MAKER MZ, the two current major versions of the engine. Both are popular game development platforms published by Gotcha Gotcha Games Inc. Any installation of these tools on Windows, macOS, or Linux systems is potentially affected. The attack requires loading a malicious save file, so exposure is limited to developers who actively use the save-loading feature during development or testing.

Exploitability

Exploitation requires local file access and user interaction—an attacker cannot remotely trigger the vulnerability. However, the bar for user interaction is relatively low: a developer simply needs to load a save file, which is a normal part of game testing and development. Save files are frequently shared in game modding communities, development teams, and online repositories. An attacker could distribute malicious save files through compromised websites, community forums, or social engineering, making exploitation practical. No authentication or special privileges are required from the victim's perspective; the application runs with whatever privileges the developer has granted it.

Remediation

Obtain and install patched versions of RPG MAKER MV and MZ from Gotcha Gotcha Games Inc. once they are released. Verify patch availability and version numbers through the official vendor website or within the application's update mechanism. Until patched, developers should avoid loading save files from untrusted sources, particularly from the internet, community mods, or third-party collections. Restrict file permissions on development machines and consider using sandboxed or isolated environments when testing with unknown save files.

Patch guidance

Monitor the official RPG MAKER website and Gotcha Gotcha Games Inc. channels for security updates. When patches become available, verify the version numbers against the vendor advisory before deployment. Apply patches to all installations of MV and MZ used within your organization. For enterprise game development teams, coordinate patching across all developer machines to ensure consistent protection. Consider automated deployment mechanisms if managing multiple installations.

Detection guidance

Monitor for suspicious processes spawned from RPG MAKER MV or MZ runtime environments, particularly shell interpreters (cmd.exe, bash, PowerShell) or system utilities initiated during save-file loading. Check save-file directory access patterns and watch for unusual file writes to system directories immediately after save-file loading. On Windows, monitor for command execution events with parent process rpgmaker*.exe or similar. Endpoint detection and response (EDR) tools should flag unexpected child processes created by game development engines. Log review should focus on save-file loading events that precede system command execution.

Why prioritize this

While the CVSS score of 7.8 indicates a HIGH severity vulnerability with significant impact, the real-world prioritization depends on organizational exposure. Organizations with many game developers or studios actively using RPG MAKER MV/MZ should prioritize patching immediately, as the attack vector (malicious save files in development workflows) is practical and difficult to defend against through behavioral controls alone. Smaller organizations or those without RPG MAKER users can defer patching until patches are available, but should begin planning remediation now. The lack of KEV-listed exploit code does not lower the priority if your organization is in scope.

Risk score, explained

The CVSS 3.0 score of 7.8 (HIGH) is driven by complete confidentiality, integrity, and availability impact (C:H, I:H, A:H) on the local system. The attack vector is local (AV:L), no special privileges are required to exploit it (PR:N), and the attack complexity is low (AC:L), meaning straightforward crafting of a malicious save file is sufficient. User interaction is required (UI:R), which prevents remote-only exploitation and slightly reduces the base score, but does not meaningfully limit practical risk in development environments where save-file loading is routine.

Frequently asked questions