Vulnerabilities

ROBLOX has had it's fare share of vulnerabilities that can be used malicious, this is a place where most (if not, all) are documented

Documentation

Vulnerability Information	Affected Applications	Affected Dates	Patch	Severity
Loadstring can run bytecode	Client & Studio.	Patched on August 3rd, 2012	Disallow the execution of bytecode in the loadstring function	CRITICAL
:Chat has no check on length, can be used to crash RCCService	RCCService.	Patched in 2020	No patch.	CRITICAL
Lots of UI's can cause de-spawning of CoreGUI	Studio & Client.	Patched in 2021	No patch, POC.	CRITICAL
__gc can be used to execute the sandbox	Needs more info.	2006-2009	Remove the __gc metamethod.	HIGH
Instance::setParentInternal can parent tools to StarterPack, StarterCharacterScripts, and StarterGear regardless of FilteringEnabled	Needs more info.	Patched in 2023	No patch yet, This only works when RakNet (or ROBLOX) calls this function internally, POC can be seen here	HIGH
Shirts with bad cHRM (or any) chunk data can be used maliciously to crash others	Client & Studio(?).	2014	Re-encode images heavily.	HIGH
Scripts can access ClientReplicators and get the MachineAddress property, allowing them to IP log users that join their game.	Client.	Patched on November 17th, 2016	Set the context level of MachineAddress to RobloxScriptSecurity.	HIGH
Crypt::verifySignatureBase64 has a buffer overflow if signature length exceeds 1024 bytes -- can be used to crash servers that process tickets or initiate a buffer overflow exploit (although no PoC has been created yet)	Needs more info.	2009-2018	Check for signature size before processing	MEDIUM
CVE-2011-3026 can stop a user's avatar from loading.	Website, (?)	Needs more info.	Allow file uploads of 1mb for png's at most.	LOW