Cyberpunk 2077 mods open PC players to vulnerabilities, developer warns

Some custom mod files for Cyberpunk 2077 pose genuine security risks to PC players, according game's developer, CD Projekt Red, which tweeted as much yesterday, warning players about the reported vulnerabilities and assuring them that the issue “will be fixed ASAP.”

Sigh. And just when we thought the drama surrounding Cyberpunk 2077’s rollout had finally died down a bit.

The malicious mods in question aren’t created by CD Projekt Red — instead, they’re fan-made customizations that can be posted by anyone. It’s these “unknown sources” that CD Projekt Red wants to warn players about. According to the company, there’s some sort of vulnerability in the external DLL files used by the game, and this vulnerability allows would-be attackers to execute code on people's PCs.

This time around the problem doesn’t stem from CD Projekt Red’s poor planning, though it’s somewhat worrisome that, less than a week after its release, the game’s official modkit has already been compromised. Just another unfortunate event for the company in a long series of them.

Problematic mods — Cyberpunk 2077 can’t seem to catch a break. After a horrifically buggy rollout and more than a few botched apologies, the game finally seemed to be finding some sort of equilibrium. There was enough calm — albeit brief calm — to release the game’s official modkit last week, for example.

The kit isn’t all that robust just yet, but bored fans have already let their imaginations run wild. A little too wild. The game’s creators had to officially ask players to stop creating mods that might cause unintentional harm — like one that allowed them to have sex with Keanu Reeves’ character. Now the game’s developers have to mitigate real-world harm for players, too.

Cyberwrecked — For now, CD Projekt Red says the best way to ensure your PC isn’t compromised by the game is to avoid mods from “unknown sources.” That’s a very broad category. There aren’t any “official” mods, only ones created by fans and, as such, they’re essentially all unverified. The only way to ensure a mod is safe, for now, is to create it yourself. Or only use those from friends you trust.

The game’s developers would do well to secure the modkit sooner rather than later — both because security vulnerabilities are dangerous, and because the addition of mods could actually breathe new life into the Cyberpunk 2077 universe... and potentially make it the sort of game many players hoped it would be.