Malicious Steam Workshop Maps Exploit MECCHA CHAMELEON Flaw for Remote Code Execution

Security researchers have identified a vulnerability in the MECCHA CHAMELEON platform that allowed specially crafted maps from the Steam Workshop to write files to any location on a Windows computer. The flaw could enable an attacker to place malicious code that runs automatically the next time the system is restarted, effectively providing remote code execution capabilities.

MECCHA CHAMELEON is a popular modding framework used by many community‑driven games to load custom content. The Steam Workshop serves as the primary distribution channel for these maps, letting players download and install user‑generated levels with a few clicks. Because the platform automatically loads map data at launch, any unchecked file operations can have system‑wide consequences.

The vulnerability stemmed from the way the engine handled map assets. Attackers could embed payloads that directed the game to write files outside the intended game directory, bypassing the sandbox that normally isolates user content. Once the rogue files were in place, they could be executed on the next system boot, granting the attacker the ability to run arbitrary code with the privileges of the logged‑in user.

The issue was uncovered by researchers at Aikido Security, who promptly reported it to the developers. A patch was released shortly thereafter, closing the file‑write loophole and adding stricter validation for workshop content. The flaw was originally brought to public attention by the security blog GBHackers, which highlighted the potential for widespread exploitation given the popularity of custom maps.

Experts advise Windows users who play games that rely on MECCHA CHAMELEON to apply the latest update without delay and to verify that their Steam client is set to automatically install patches. The incident underscores the broader security challenges faced by mod‑friendly ecosystems, where user‑generated content can be both a strength and a vector for abuse. Ongoing monitoring and tighter sandboxing are likely to become focal points for developers aiming to balance creativity with safety.