| Version | Supported |
|---|---|
| 0.1.x | ✅ Active |
UEBPCracker is currently in active development. Security fixes are applied to the latest release only.
UEBPCracker is an editor-only, local-development plugin. It is designed to run exclusively on localhost (loopback bind enforced by default). The MCP endpoint is not intended to be exposed to external networks.
In-scope for security reports:
- Authentication bypass on the MCP endpoint
- Path traversal allowing reads/writes outside configured content roots
- Arbitrary code execution via crafted tool call payloads
- Policy enforcement bypass (e.g., write gate, destructive operation gate, plan hash validation)
- Information disclosure of local file system paths beyond what the plugin intentionally exposes
Out-of-scope:
- Vulnerabilities in Unreal Engine itself (report to Epic Games)
- Vulnerabilities in Unreal MCP (report to Epic Games)
- Issues requiring the attacker to already have local code execution on the machine
- Running the plugin in a networked/production environment (explicitly unsupported)
Please do not open a public GitHub issue for security vulnerabilities.
Report vulnerabilities privately by emailing the maintainer through the contact channels listed on yildizportfolio.com.
Include in your report:
- A description of the vulnerability and its potential impact
- Steps to reproduce (tool call payloads, config, UE version)
- Any suggested mitigations
You can expect an acknowledgement within 5 business days and a resolution timeline within 30 days for confirmed issues.
UEBPCracker implements a layered security model:
| Layer | Mechanism |
|---|---|
| Network | Loopback-only bind (bAllowRemoteMCPBind=false by default) |
| Write gate | bEnableWriteOperations must be explicitly set to true in INI |
| Content root | Configurable allow-list; segment-boundary enforcement (no prefix matching) |
| Destructive ops | bEnableDestructiveOperations=false by default |
| Patch integrity | Sealed plan hash required (bRequirePlanHashForPatch=true) |
| Reflection | Function and component targets validated against a reviewed allow-list |
| Dirty guard | Mutation blocked on packages with unsaved changes |
| Path traversal | Absolute path + traversal + containment checks on all inputs |
| Logging | Absolute user paths and spec content redacted in all log output |
Error codes for security violations follow the UEBP.SECURITY_* and UEBP.PATH_* taxonomy documented in UEBPCrackerTypes.h.