Isolate Genesis World Instances to Block Directory Traversal Flaws
Zero Day Initiative reports three unpatched flaws in Genesis World that enable information disclosure and remote code execution via manipulated file paths.
Key points
- Three vulnerabilities in Genesis World allow directory traversal, leading to data leakage or code execution.
- Zero Day Initiative assigned CVSS scores of 5.5 for information disclosure and 7.8 for remote code execution.
- The vendor closed a security policy request on GitHub, prompting ZDI to publish the advisories.
The risk
Zero Day Initiative published advisories on October 13, 2026, detailing three flaws in the Genesis World library. The issues stem from insufficient path validation during file operations. Flaws ZDI-26-754 and ZDI-26-753 involve parsing URDF and MJCF files respectively, allowing attackers to disclose sensitive information. A third flaw, ZDI-26-752, resides in the decompress_usdz function and permits arbitrary code execution. All three require interaction with the library but vary in attack vectors based on implementation.
Who is exposed
Organizations using Genesis World installations are exposed to these risks. Exploitation requires an attacker to supply a malicious path to the library. Because the flaws allow actions in the context of the current process or user, any system running the vulnerable library faces potential compromise. The Zero Day Initiative noted that the only effective mitigation is restricting interaction with the product entirely until further notice.
Cost and compliance
The Zero Day Initiative assigned a CVSS rating of 5.5 to the information disclosure vulnerabilities. The remote code execution flaw received a higher CVSS score of 7.8. These ratings reflect the potential impact on confidentiality and integrity. The coordinated public release occurred on October 13, 2026, following a report to the vendor on September 25, 2026. No compliance frameworks are mentioned in the advisories.
Our take on the response
The vendor’s handling of the disclosure process appears minimal. Zero Day Initiative emailed a contributor on July 16, 2026, to request a secure channel. On July 28, 2026, ZDI asked the vendor to update its security policy via a GitHub issue, which the vendor closed the same day. ZDI followed up on August 6, 2026, requesting PSIRT contacts. ZDI notified the vendor of its intent to publish on September 11, 2026.
What defenders should look for
Teams usually monitor for unusual file access patterns originating from services running this library. Check whether processes are attempting to read files outside expected directories. Look for alerts indicating path traversal sequences in web or application logs. If detection occurs, isolate the affected host immediately to prevent lateral movement. Review access logs for any successful reads of sensitive configuration or credential files. Do not restart services without confirming the scope of the breach first.
What to do and how to stay safe: Genesis World
- Restrict network access to any system running Genesis World to prevent remote exploitation.
- Audit file permissions to ensure the library cannot access sensitive directories outside its scope.
- Monitor system logs for unexpected file reads or process executions triggered by library interactions.
- Prepare to disable the library in production environments once the vendor provides an update.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific functions are vulnerable in Genesis World?
The parsing of URDF files, the parsing of MJCF files, and the decompress_usdz function are vulnerable.
Can attackers execute code through these flaws?
Yes, the decompress_usdz function allows arbitrary code execution in the context of the current user.
Did the vendor provide a patch?
No, the source material indicates these are 0-day advisories with no confirmed fix from the vendor.
