Genesis World Users Face Code Execution Risk From Unpatched Directory Traversal Flaws
Zero Day Initiative disclosed three vulnerabilities in Genesis World, including a remote code execution flaw, with no fix available as of October 2026.
Key points
- ZDI assigned CVSS 7.8 to a remote code execution vulnerability in Genesis World's decompress_usdz function.
- Two additional information disclosure flaws in URDF and MJCF parsing were rated CVSS 5.5 each.
- No patch has been confirmed; the only mitigation is restricting interaction with the library.
Organizations using the Genesis World robotics simulation library must restrict access immediately, as three unpatched vulnerabilities allow attackers to execute code or steal sensitive data. The Zero Day Initiative disclosed these flaws on October 13, 2026, noting that no vendor fix has been released. The most severe issue enables arbitrary code execution, posing a direct risk to systems processing untrusted files.
How it unfolded
- On July 16, 2026, the Zero Day Initiative emailed a Genesis World contributor to request a secure channel for vulnerability disclosures.
- By July 28, 2026, ZDI asked the vendor to update their security policy via a GitHub issue, which the vendor subsequently closed.
- On September 25, 2026, ZDI formally reported the vulnerability to the vendor, followed by a coordinated public release on October 13, 2026.
Who is affected
The Zero Day Initiative identified three distinct flaws in Genesis World installations. The first, ZDI-26-752, affects the decompress_usdz function and allows remote attackers to execute arbitrary code in the context of the current user. This vulnerability received a CVSS rating of 7.8, classifying it as high severity. Exploitation requires interaction with the library, but attack vectors depend on implementation.
Two additional flaws, ZDI-26-753 and ZDI-26-754, involve directory traversal during the parsing of MJCF and URDF files respectively. These issues allow remote attackers to disclose sensitive information within the current process context. Both were assigned a CVSS rating of 5.5. The ZDI noted that proper validation of user-supplied paths was lacking in all three cases, enabling file operations that bypass intended restrictions.
Our take on the response
The Zero Day Initiative reported these issues to the vendor on September 25, 2026, yet no patch was available at the time of the October 13, 2026, disclosure. The advisory emphasizes that restricting interaction with the product is the only salient mitigation strategy. The vendor’s initial closure of a GitHub issue regarding security policy updates highlights challenges in establishing clear communication channels for security researchers during the disclosure process.
Who needs to act first
Managed service providers should prioritize isolating systems that process external Genesis World files. Teams usually begin by identifying which servers or workstations run this library and whether they accept untrusted input. Verify if these systems are exposed to networks where attackers could deliver malicious URDF, MJCF, or USDZ files. Restrict network access to these endpoints immediately. If possible, disable the specific parsing functions until a vendor update is released. Document all affected assets to streamline remediation later.
Background: Attack vectors
Attack vectors are the paths adversaries use to reach your data. They range from simple phishing emails to complex supply chain compromises. Defending against them requires mapping every entry point, validating inputs, and limiting what each component can do. You cannot stop all attacks, but you can make them costly and slow.
Read the full guide: Attack Vectors Explained: Mechanisms, Limits, and Defense Strategies
What to do and how to stay safe: Genesis World
- Audit all environments running Genesis World to determine if they process files from untrusted or external sources.
- Implement network segmentation to isolate systems running this library from general user networks and the internet.
- Monitor logs for unusual file access patterns or process executions that could indicate exploitation of path traversal flaws.
- Wait for an official vendor update before attempting manual patches, as applying unverified fixes may introduce instability or new vulnerabilities.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a patch available for these Genesis World vulnerabilities?
No, the Zero Day Initiative advisory states that no fix has been confirmed, and restricting interaction is the only mitigation.
What is the severity of the remote code execution flaw?
The ZDI assigned a CVSS rating of 7.8 to the remote code execution vulnerability in the decompress_usdz function.
Which file formats are affected by these directory traversal issues?
The vulnerabilities affect the parsing of URDF, MJCF, and USDZ files within the Genesis World library.
