Vulnerability · Published Jun 30, 2026 · Assigned by jpcert
CVE-2026-56137
High 7.8
In plain English
A high-severity OS command injection in RPG MAKER MV from Gotcha Gotcha Games Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Severity (CVSS 3.0)7.8High
Exploit odds (30 days)1.1%top 34.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerability. If a user loads a specially crafted save-file, arbitrary OS command may be executed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Gotcha Gotcha Games Inc. | RPG MAKER MV | 1.6.3 and earlier |
| Gotcha Gotcha Games Inc. | RPG MAKER MZ | 1.10.0 and earlier |
Weakness: CWE-78 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H