Minecraft
Monthly
Command-line argument injection into the yt-dlp invocation used by the Dream Displays Minecraft mod/plugin (versions 1.5.0 through 1.8.1) lets player-supplied media/watch-party URLs carry option-like tokens that yt-dlp parses as its own command-line flags, altering the downloader's behaviour. The impact is scored as integrity-only (CVSS 4.0 8.7, and an assessed 3.1 vector of AV:N/AC:L/PR:N/UI:N with C:N/I:H/A:N), and exploitation is confined to servers actually running a vulnerable release with the display/watch-party feature in use; no public exploit code was identified at time of analysis and the issue does not appear in CISA KEV. The vendor fixed the flaw in version 1.8.2 by validating URLs against a media URL policy and inserting an end-of-options marker before passing them to yt-dlp.
Concurrent transcript writes and hourly retention cleanup in the VoiceSentinel Processor's opt-in report buffer (versions 2.2.1 through 3.3.0) can lose, duplicate or corrupt transcript records and silently defeat retention pruning, so the buffer stops shrinking and grows until the processor host's disk fills and the machine or co-located services crash. The flaw is a check-then-act race: cleanup reads and rewrites transcripts.jsonl in place while appends land from a separate thread, and multiple _processing_worker tasks make the collision reachable during normal operation, especially with processing.worker_count of 2 or more or a shared public-pool deployment using one server_key. Exploitation is gated behind report_buffer.enabled being set to true (off by default), the outcome is timing- and load-dependent, and no public exploit code or active exploitation was identified at time of analysis; the vendor-released patch is 3.3.1.
Item duplication in InventoryGui before version 1.6.5 affects any Bukkit/Spigot plugin whose GUI uses the library's GuiStorageElement and allows players to take items out of that element while the server's experimental Bundle item feature is enabled. An authenticated in-game player interacting with such a GUI can duplicate items, an integrity-only impact confined to in-game economy; there is no confidentiality or availability effect. No public exploit code was identified at time of analysis, EPSS is very low (0.22%, 12th percentile), and the vendor has released a patch in version 1.6.5 that primarily disables GuiStorageElement on servers older than Minecraft 1.21.9.
Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code execution, via crafted world data that contains a symlink. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::_read (packet deserializer). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Minecraft before 1.17.1, when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Command-line argument injection into the yt-dlp invocation used by the Dream Displays Minecraft mod/plugin (versions 1.5.0 through 1.8.1) lets player-supplied media/watch-party URLs carry option-like tokens that yt-dlp parses as its own command-line flags, altering the downloader's behaviour. The impact is scored as integrity-only (CVSS 4.0 8.7, and an assessed 3.1 vector of AV:N/AC:L/PR:N/UI:N with C:N/I:H/A:N), and exploitation is confined to servers actually running a vulnerable release with the display/watch-party feature in use; no public exploit code was identified at time of analysis and the issue does not appear in CISA KEV. The vendor fixed the flaw in version 1.8.2 by validating URLs against a media URL policy and inserting an end-of-options marker before passing them to yt-dlp.
Concurrent transcript writes and hourly retention cleanup in the VoiceSentinel Processor's opt-in report buffer (versions 2.2.1 through 3.3.0) can lose, duplicate or corrupt transcript records and silently defeat retention pruning, so the buffer stops shrinking and grows until the processor host's disk fills and the machine or co-located services crash. The flaw is a check-then-act race: cleanup reads and rewrites transcripts.jsonl in place while appends land from a separate thread, and multiple _processing_worker tasks make the collision reachable during normal operation, especially with processing.worker_count of 2 or more or a shared public-pool deployment using one server_key. Exploitation is gated behind report_buffer.enabled being set to true (off by default), the outcome is timing- and load-dependent, and no public exploit code or active exploitation was identified at time of analysis; the vendor-released patch is 3.3.1.
Item duplication in InventoryGui before version 1.6.5 affects any Bukkit/Spigot plugin whose GUI uses the library's GuiStorageElement and allows players to take items out of that element while the server's experimental Bundle item feature is enabled. An authenticated in-game player interacting with such a GUI can duplicate items, an integrity-only impact confined to in-game economy; there is no confidentiality or availability effect. No public exploit code was identified at time of analysis, EPSS is very low (0.22%, 12th percentile), and the vendor has released a patch in version 1.6.5 that primarily disables GuiStorageElement on servers older than Minecraft 1.21.9.
Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code execution, via crafted world data that contains a symlink. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::_read (packet deserializer). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Minecraft before 1.17.1, when online-mode=false is configured, allows path traversal for deletion of arbitrary JSON files. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.