CVE-2023-38689

Logistics Pipes is a modification (a.k.a. mod) for the computer game Minecraft Java Edition. The mod used Java's `ObjectInputStream#readObject` on untrusted data coming from clients or servers over the network resulting in possible remote code execution when sending specifically crafted network packets after connecting. The affected versions were released between 2013 and 2016 and the issue (back then unknown) was fixed in 2016 by a refactoring of the network IO code. The issue is present in all Logistics Pipes versions ranged from 0.7.0.91 prior to 0.10.0.71, which were downloaded from different platforms summing up to multi-million downloads. For Minecraft version 1.7.10 the issue was fixed in build 0.10.0.71. Everybody on Minecraft 1.7.10 should check their version number of Logistics Pipes in their modlist and update, if the version number is smaller than 0.10.0.71. Any newer supported Minecraft version (like 1.12.2) never had a Logistics Pipes version with vulnerable code. The best available workaround for vulnerable versions is to play in singleplayer only or update to newer Minecraft versions and modpacks.

• CWE-502

• https://github.com/RS485/LogisticsPipes/commit/39a90b8f2d1a2bcc512ec68c3e139f1dac07aa56Patch
• https://github.com/RS485/LogisticsPipes/commit/527c4f4fb028e9afab29d4e639935010ad7be9e7Product
• https://github.com/RS485/LogisticsPipes/security/advisories/GHSA-mcp7-xf3v-25x3Mitigation, Patch, Vendor Advisory
• https://github.com/RS485/LogisticsPipes/commit/39a90b8f2d1a2bcc512ec68c3e139f1dac07aa56Patch
• https://github.com/RS485/LogisticsPipes/commit/527c4f4fb028e9afab29d4e639935010ad7be9e7Product
• https://github.com/RS485/LogisticsPipes/security/advisories/GHSA-mcp7-xf3v-25x3Mitigation, Patch, Vendor Advisory

Published

Aug 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38683A vulnerability has been identified in JT2Go (All versions <…7.8
• CVE-2023-38684Discourse is an open source discussion platform. Prior to ve…7.5
• CVE-2023-38685Discourse is an open source discussion platform. Prior to ve…4.3
• CVE-2023-38686Sydent is an identity server for the Matrix communications p…5.3
• CVE-2023-38687Svelecte is a flexible autocomplete/select component written…5.4
• CVE-2023-38688twitch-tui provides Twitch chat in a terminal. Prior to vers…7.5
• CVE-2023-3869The wpDiscuz plugin for WordPress is vulnerable to unauthori…5.3
• CVE-2023-38690matrix-appservice-irc is a Node.js IRC bridge for Matrix. Pr…9.8
• CVE-2023-38691matrix-appservice-bridge provides an API for setting up brid…6.5
• CVE-2023-38692CloudExplorer Lite is an open source, lightweight cloud mana…9.8
• CVE-2023-38693Lucee Server (or simply Lucee) is a dynamic, Java based, tag…9.8
• CVE-2023-38694Umbraco is an ASP.NET content management system (CMS). Start…5.4