JVN#69681784    
RPG MAKER MV and MZ vulnerable to OS command injection

RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerability.

• RPG MAKER MV versions 1.6.3 and earlier
• RPG MAKER MZ versions 1.10.0 and earlier

RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. are game development tools, which provide "save data" facility to create a file to preserve game status and related parameters. A user can save the current game status to a save-file, and later load the file to resume playing the game.
When loading a save-file, RPG MAKER MV and MZ fail to properly treat crafted contents, and may lead to OS command injection.

• OS Command Injection (CWE-78)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
  • CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Base Score 7.8
  • CVE-2026-56137

If a user loads a specially crafted save-file, arbitrary OS command may be executed.

Apply the Workaround
The developer recommends the users not to load untrusted save-file.

Vendor	Link
Gotcha Gotcha Games Inc.	Notice Regarding the Handling of Games, Save Data, and Assets from Unknown Sources

Shuta Ide of GMO Flatt Security Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.