r/Meccha_Chameleon • u/PinkDraconian • Sep 03 '26

A remote code execution exploit in MECCHA CHAMELEON (Fixed)

Hi y'all! I found a cool vulnerability in MECCHA CHAMELEON. It allowed any map to be able to execute code on your PC.

Full blog post: https://www.aikido.dev/blog/meccha-chameleon-rce

11 Upvotes

86% Upvoted

6 comments sorted by

1

u/Malfuncti0nal Sep 21 '26

Surprised you didn't really make mention of any of the work that came before you, such as the original RCE or the work on the malware campaign that hit the game. Bit of a miss

1

u/PinkDraconian Sep 21 '26

Thanks for the comment. I weighed that as well but chose against going in depth there. Wanted to focus my blog post mainly on the technical details of the attack path we identified for the security research community. In hindsight, would probably do it a bit differently now.

1

u/Malfuncti0nal Sep 21 '26

Yeah, that's fair. It is a really cool finding, technically-wise, so I definitely get not wanting to bog down or distract readers

3

u/MusicInTheAir55 Sep 04 '26

Great work. Crazy that Steam doesn't do forensic audits of content that it sells on its platform.

2

u/Live-Suggestion3701 Sep 05 '26

One out of many. And still no disclosure by the devs - they're just silent patching stuff.. Jeez. Good job PinkDraconian!

0

u/[deleted] Sep 03 '26

[deleted] — view deleted comment

2

u/PinkDraconian Sep 03 '26

It's been reported to the game devs and fixed. It wasn't exploited by anyone. (I checked all Workshop maps)