Engine exploit allows bad actors to load scripts in character assets to achieve serverside execution

[Lonegwadiator (Glad)]

This is quite sensitive, I’d rather explain in the private section below.

A private message is associated with this bug report

[TheGamer101]

Hey,

We resolved this issue in private communication a while ago but wanted to post here to mention that we have completed rolling out a change to the default AssetTypeVerification in HumanoidDescription APIs to enhance the security of loading character assets:

[Potential Action Required] Update for HumanoidDescription APIs

[Update] October 20, 2025 Hi Creators, To better protect your experiences from potential security vulnerabilities, we are updating the default behavior of two of our widely used APIs: Humanoid:ApplyDescription and Players:CreateHumanoidModelFromDescription. [Updated] The changes will go into effect 10/27/2025. For best development practices, if your experience is using either of these APIs and allows users to equip custom assets or non-avatar catalog items, action is needed to accommodate fo…

Thanks for your report!