CVE-2026-56137

Summary

RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerability. If a user loads a specially crafted save-file, arbitrary OS command may be executed.

Affected Software

VendorProductVersion RangeStatus
Gotcha Gotcha Games Inc.RPG MAKER MV1.6.3 and earlieraffected
Gotcha Gotcha Games Inc.RPG MAKER MZ1.10.0 and earlieraffected

Weaknesses

  • CWE-78: Improper neutralization of special elements used in an OS command ('OS Command Injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References