High
CVE-2026-25546
Godot MCP is a Model Context Protocol (MCP) server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in godot-mcp allows remote code execution. The…
Tag: Godot
All CVEs associated with "Godot". Page 1/1 • 5 CVEs.
About “Godot”
A curated feed of “Godot”-related CVEs appears below. We currently track 5 CVEs for this tag (all time). In the last 365 days, 1 were published. Average CVSS is 8.1 (all time; 7.8 over 365d), and 100% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
In our taxonomy this topic maps to a LOW impact class. Game engines and tooling can ship inside applications. Patch engines, pin dependencies, sandbox editor plugins, and validate assets. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.
Support & lifecycle: godot
This table shows recent release cycles and their projected end-of-life. Data source: endoflife.date.
| Cycle | Release | Latest | Premier Support | EOL | LTS |
|---|---|---|---|---|---|
| 4.6 | 4.6.3 | Unavailable | - | ||
| 4.5 | 4.5.2 | - | |||
| 4.4 | 4.4.1 | Expired | |||
| 3.6 | 3.6.2 | Unavailable | - | LTS | |
| 4.3 | 4.3 | Expired | |||
| 4.2 | 4.2.2 | Expired | |||
| 4.1 | 4.1.4 | Expired | |||
| 4.0 | 4.0.4 | Expired | |||
| 3.5 | 3.5.3 | Expired | LTS | ||
| 3.4 | 3.4.5 | Expired | |||
| 3.3 | 3.3.4 | Expired | |||
| 3.2 | 3.2.3 | Expired | |||
| 3.1 | 3.1.2 | Expired | |||
| 3.0 | 3.0.6 | Unavailable | - Expired | ||
| 2.1 | 2.1.6 | Unavailable | - Expired | LTS | |
| 2.0 | 2.0.4.1 | Unavailable | - Expired | ||
| 1.0 | 1.0 | Unavailable | - Expired |
Maintained Soon (≤ 180 days) Expired
Subscribe lifecycle: RSS · RSS (expired) · ICS
Subscribe CVEs: RSS for “Godot” · RSS (High+Critical only)
CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).
CVSS ≥ 0.0
2026-02-04
2021-02-08
High
CVE-2021-26826
A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. Depending on the context of the application, attack vector can be loc…
High
CVE-2021-26825
An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files. The vulnerability exists in ImageLoaderTGA::load_image() function at…
2019-05-31
Critical
CVE-2019-10069
In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly.
2018-08-20
High
CVE-2018-1000224
Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer overflow, missing padding initialization v…