Unturned Patches RCE Exploit Found in Workshop Mod

On the evening before this patch's release, Smartly Dressed Games received a report of a remote code execution (RCE) exploit embedded in a workshop mod hosted on a malicious server. As a precaution, the studio temporarily disabled all Internet server listings while preparing and deploying the fix. The developer states it believes impact was limited to a single small server, and a scan of the past month of workshop uploads found no other instances of the exploit being used.

Credit for the disclosure goes to celeb for the initial report, Jdance for producing a proof-of-concept (first raised through the community Discord), and Daniel Willett for conducting the broader workshop scan.

What changed

• RCE fix: The game now blocks loading of components with UnityEvents connected to static methods — a vector that could be exploited to invoke restricted calls such as Application.OpenURL.
• Follow-up patch (3.26.3.6): Addresses an error triggered when a component is missing its script during event validation; also ignores events that have not been configured.

Collateral effect on mods

The fix carries a side consequence: mods with event-configured components pointing to objects that no longer exist (e.g., a particle system removed without updating its linked event) will now produce "missing Item GameObject" errors and cause custom items or objects to disappear from levels and servers. Because this pattern is technically indistinguishable from an exploit attempt, it must be blocked. Affected mods require an update from their creators; the error log will indicate the precise component and event at fault.

For players, the practical upshot is that Internet servers are back online and the exploit window appears to have been narrow — but some modded servers may show missing content until their authors push fixes.