When it comes to using the internet in any way, a general rule of thumb is that you should never download software from a source that you do not trust. Yesterday, CD Projekt Red
Support sent out a tweet to dissuade people from downloading mods for Cyberpunk 2077
because a vulnerability
was found the modding system's implementation.
CD Projekt Red’s tweet explained the issue occurs when malicious mods are downloaded and modify things that they should not change. The tweet then explains that this vulnerability will be fixed “ASAP,” but it is quite dangerous to players who have already ventured out to install mods.
For a deeper explanation of the issue, the tweet further states that Cyberpunk 2077 would use external dynamic linked library (DLL) files when running the game. Andrew Kramer, a Dakota State University professor of computer science, speculates that this is case of DLL hijacking whereby a mod could include a malicious DLL that could be executed by Cyberpunk 2077. Ultimately, this issue likely falls under the purview of common weakness enumeration (CWE) 427, which explains that “The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.”
No matter the specifics, this issue poses an undue security
risk to Cyberpunk 2077 players who want to mod their game. For the time being, it is best to avoid mods from Cyberpunk 2077 altogether until CD Projekt Red and independent researchers can verify that all the kinks are worked out. Hopefully, no more issues will crop up, though, but keep an eye on HotHardware
for updates if they do.