VDB

GCVE-110-OSM-2026-741

GCVE-110-OSM-2026-741
Advisory PublishedCVSS 9.6/10
Vulnetix · Advisory published March 27, 2026
Malicious lazy proxy pattern library for Unity. Supply chain attack targeting game development infrastructure with MSBuild-based code execution. Exploits NuGet's MSBuild integration by placing malicious code in .targets files as inline tasks. When projects build, MSBuild automatically imports and executes these tasks, downloading .NET executables from throwaway GitHub repositories with embedded obfuscated command-line payloads.

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersionsPlatforms
unknownLazyProxy.Unity.Netall (affected)

Browse GCVE Records

71,925 records in the GCVE database · Updated July 13, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

$ Console Community · 100/wk Open console ›