Which versions of RPG Maker are affected by CVE-2026-56137?

RPG Maker MV and MZ contain an arbitrary command execution vulnerability (CVE-2026-56137, CVSS 8.4) that allows attackers to execute operating system commands with game process privileges when…

How to fix or mitigate CVE-2026-56137?

Within 24 hours: Identify all RPG Maker MV and MZ installations within your development and operational environments. Within 7 days: Issue user awareness communication restricting save-file loading to trusted sources only; implement technical controls to prevent imports from unverified channels where feasible. Within 30 days: Monitor Gotcha Gotcha Games security advisories for patch releases; evaluate sandboxing or containerization of RPG Maker processes to limit command execution scope.

RPG Maker CVE-2026-56137

Q: What is the CVSS score of CVE-2026-56137?

CVE-2026-56137 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-40256 HIGH

OS Command Injection (CWE-78)

2026-06-30 jpcert

GHSA-f7jr-jmf8-58m2

Command Injection Rpg Maker Mv Rpg Maker Mz

8.4

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local save-file load with no auth gives AV:L/AC:L/PR:N; victim must open the file (UI:R); arbitrary command execution yields full C:H/I:H/A:H with unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 07:32 vuln.today

CVSS changed

Jun 30, 2026 - 07:22 NVD

7.8 (HIGH) 8.4 (HIGH)

DescriptionCVE.org

RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerability. If a user loads a specially crafted save-file, arbitrary OS command may be executed.

AnalysisAI

Arbitrary OS command execution in RPG Maker MV and MZ (Gotcha Gotcha Games) is triggered when a victim loads a maliciously crafted save-file, allowing an attacker to run commands with the privileges of the game process. The flaw is a classic OS command injection (CWE-78) reported through JPCERT/JVN; no public exploit has been identified at time of analysis and it is not in CISA KEV. Because exploitation is local and requires the user to load attacker-supplied data, impact hinges on social-engineering victims into opening untrusted saves.

Technical ContextAI

RPG Maker MV and MZ are JavaScript/Node.js-based (NW.js / Electron-style) game-creation engines, which means runtime logic ships as scripts and save-data is deserialized by the engine at load time. The CWE-78 root cause indicates that data read from a save-file is passed, without adequate neutralization, into an OS command interpreter (e.g. via a shell-invoking API such as child_process or an equivalent), so attacker-controlled fields in the save are interpreted as command syntax rather than inert data. The affected CPEs are cpe:2.3:a:gotcha_gotcha_games_inc.:rpg_maker_mv and cpe:2.3:a:gotcha_gotcha_games_inc.:rpg_maker_mz, both listed with wildcard versions, indicating the affected version range was not pinned in the CPE data.

RemediationAI

Update RPG Maker MV and MZ to the fixed releases announced by Gotcha Gotcha Games; the exact patched version is not stated in the supplied data, so consult the vendor advisories at https://rpgmakerofficial.com/en/news/4188/ and https://rpgmakerofficial.com/news/4183/ and the JVN advisory at https://jvn.jp/en/jp/JVN69681784/ for the precise build numbers before deploying. As a compensating control until updating, treat save-files as untrusted input: do not load save-files received from other people, downloaded forums/Discord, or any source you did not create, since that single user action is the exploitation trigger - the trade-off is loss of legitimate save-sharing convenience. Distributors of RPG Maker games should rebuild and ship titles on the patched engine so end-player runtimes are not vulnerable, and developers can additionally run the editor/runtime under a least-privilege account to limit what an injected command can reach, at the cost of some workflow friction.