Post

insane Godot design decision of the day: `bytes_to_var` doesn't deserialize objects but `str_to_var` does, leading to code execution with absolutely no warning about it. there is a 3 yrs open issue for this problem and one of the comments with 50 likes is "hidden as abuse" github.com/godotengine/...

github.com`str_to_var` and `ConfigFile` allow for arbitrary code execution · Issue #80562 · godotengine/godotGodot version v4.1.1.stable.official [bd6af8e] System information Ubuntu 23.04 Issue description The global method str_to_var and ConfigFile's load/parse methods deserialize variants from strings, ...

NotNite

@notnite.com

@katie.cat and I found @sketbordcat.bsky.social's Horse Magnifier called this and exploited it in literally 15 minutes *while playing CS2* (this vuln was fixed in this game and isn't an issue anymore) I cannot believe this doesn't have a warning, Godot devs *really* need to care about security more

11/8/26, 9:01 pm27 reposts129 likes

viwrap

@viwrap.zip

11 Aug

wouldn't that be bytes_to_var_with_objects?

NotNite

@notnite.com

11 Aug

that's the equivalent for bytes_to_var, but str_to_var is always unsafe (and the difference between the two similarly named functions with separate object serialization behavior is probably confusing)