| Package | Affected versions | Patched versions |
|---|---|---|
| sunshine | ≥ 0.10.0, < 2025.923.33222 | 2025.923.33222 |
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free