Yesterday evening we received report of a remote code execution (RCE) exploit in a malicious server's workshop mod. As a precaution, we temporarily disabled all Internet server listings while we prepared and released this patch. At this time, we believe the impact was limited to a single small server.
Our sincere thanks to celeb for reporting the exploit, to Jdance for creating a proof-of-concept test case (initially reported through the community Discord), and to Daniel Willett for running a scan of the past month of workshop uploads to check whether this exploit had been used anywhere else (fortunately, it was not)!
Fixed
Prevent loading components with UnityEvents connected to static methods. These could be exploited to call restricted methods such as Application.OpenURL. (By default, the game filters third-party URLs.)
Edit: another patch, 3.26.3.6, has been released to fix an error when a component is missing its script during event validation, and to ignore events that haven't been configured.
Missing Content
Mods with "missing Item GameObject" (or similar) errors unfortunately require an update from the mod creator. Until then, certain custom items and objects may be missing from levels and servers.
In the cases we've reviewed, the issue was event-related components referencing a missing target object. For example, an event might be configured to trigger a particle system, but if the particle system was later removed without updating the event, the event is left pointing to an object that no longer exists.
Unfortunately, code-wise this is indistinguishable from an attempt to exploit the vulnerability, so it must be blocked.
For modders: we recommend checking the error log file. Above the missing GameObject warning should be a message with the precise component and event causing the issue.