Since 2017, bugs in CS:GO and CS2 have opened ways to run programs on players' PCs or log their IP addresses, and in 2026 old match chat from demo files turned up on a public website. Valve closed each hole, though one took almost two years from the first report. Here is what each needed from the victim and what still protects you.
CS2 and CS:GO exploits at a glance
| When | What happened | What it took | Fixed |
|---|---|---|---|
| June 2017 | A map model could run code | Joining a server with the map | June 2017 updates |
| 2019 | A kick message could run code | Joining the attacker's server | Late August 2019 |
| 2019–2021 | An invite could leak your IP and run code | Accepting one Steam invite | April 17, 2021 |
| Dec 2023 | Vote-kick images logged IPs | Seeing the vote in a match | The same day |
| Dec 2023 | Map scripts could reach inventories (reported) | Loading a Workshop map | The next day |
| Aug 2026 | Demo chat shown on a public site | Typing in match chat | September 9, 2026 |
2017: a booby-trapped ragdoll in a custom map
Remote code execution (RCE) means someone else can run programs on your computer. In 2017 One Up Security found an RCE bug in Valve's Source SDK, the code base behind CS:GO and other Source games. It was a buffer overflow: a ragdoll rule longer than 256 characters spilled past the memory set aside for it, which could hand control of the game to an attacker.
A ragdoll is the limp body a player turns into when killed. Maps can carry custom content, and a model packed under an original's path replaces it, so a booby-trapped map could run code as soon as someone was fragged on it.
Valve patched CS:GO, Team Fortress 2, Portal 2 and other Source games during June 2017, the more popular ones within a day.
2019: kick messages that ran code
CS:GO's interface ran on Panorama, a Valve framework built like a web page with HTML, CSS and JavaScript. In June 2019 two researchers reported to Valve's bug bounty on HackerOne that the pop-up shown when a server disconnects you treated its text as raw HTML.
Their proof of concept was a kick message hiding a script: moving the mouse over the text opened a program on the player's PC. A server that kicked everyone automatically would do, they wrote, so a victim only had to join it.
Valve's update at the end of August 2019 stopped community servers showing unsafe HTML in disconnect messages. The community servers guide explains how player-run servers work in CS2.
2019 to 2021: one accepted Steam invite
A Steam game invite carries a connect string telling the game what to join. In June 2019 a researcher known as floesen reported that if the game wasn't running, accepting an invite added that string to its launch options, letting an attacker slip in console commands. The game then connected back to the attacker without any notice, which alone revealed the victim's IP address.
That connection used RCON, the remote console server owners use to run commands. The game accepted RCON messages it never asked for, so the attacker could upload files, and a bug in a zip library from 2003 let them run any program.
Valve rated it 9.0, critical, and paid an $8,000 bounty in October 2020. CS:GO was still vulnerable in April 2021, and by the final patch on April 17 Valve had removed the RCON handlers involved. The flaw was in the original Source engine; games built on Source 2, which CS2 uses, weren't affected.
2020: the source code scare
In April 2020, CS:GO and Team Fortress 2 source code was reported leaked, with early warnings that playing could put your computer at risk. On April 22 Valve said it was a reposting of a limited CS:GO engine code depot given to partners in late 2017 and first leaked in 2018, and that it had found no reason for players to be alarmed.
Valve added that "as always, playing on the official servers is recommended for greatest security." Leaks on Valve's own side are covered in Steam data breaches and leaks.
December 2023: the vote-kick panel and Workshop maps
CS2 kept Panorama. On December 11, 2023, players were abusing its vote-kick panel, which displayed HTML: put an image tag in your Steam name, call a vote to kick yourself, and every player shown the vote saw the picture.
Mostly it was pranks, but some pointed the image at an IP logger, a server that records the address of every computer fetching the picture. A known IP address can be hit with a DDoS attack, a traffic flood that knocks a player out of the match.
BleepingComputer reported it was HTML injection only, allowing images, rather than cross-site scripting (XSS), which would let injected JavaScript run. Valve's 7MB update that afternoon reportedly made the game show any HTML as plain text.
Workshop maps had come to CS2 on November 2. On December 11, community accounts on X warned that a Workshop map could carry a script that used Panorama to act on the inventory of whoever loaded it, in theory deleting items, applying or scraping stickers, opening cases and doing trade-ups. According to dataminer Gabe Follower, the next day's fix disabled custom Panorama elements and scripts packed in maps.
2026: match chat in demo files
A demo is a match recording the game can replay. In late August 2026, players found a third-party CS2 stats site showing their old chat on public profiles, taken from match demos and tagged with the map, round and time. One profile held more than 2,800 messages from 388 matches.
Valve's September 9, 2026 update encrypted demo chat under the same rules as CS:GO: team chat can't be read in playback, and global chat shows only when a demo is played through the in-game Watch menu. The CS2 demos guide covers watching them.
What protects you now
- Keep the game updated. Most of the fixes above shipped in ordinary game updates, and both December 2023 fixes came within a day.
- Be choosy about where you play. Most of these attacks needed you to join a server, load a map or accept an invite. Valve's 2020 statement recommended its official servers for the greatest security, so decline invites from strangers and stick to Workshop maps from creators you trust.
- Treat match chat as public. Anyone who watches a demo in the game can still read its global chat.
- Clean up if something ran. From a device you trust, follow Valve's steps for a compromised account, which include checking Authorized Devices, using Sign out everywhere, changing your Steam password and scanning for malware. The Steam malware guide covers what an infostealer takes.
- Report bugs privately. Valve takes vulnerability reports through HackerOne, where the 2019 and 2021 bugs were reported; account problems go to Steam Support.
Sources
- Remote Code Execution In Source Games — One Up Security
- Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect Message — HackerOne
- CVE-2021-30481: Source engine remote code execution via game invites — secret club
- Update: It's Probably Okay To Play Counter-Strike and Team Fortress 2 Right Now — Game Informer
- Counter-Strike 2 HTML injection bug exposes players' IP addresses — BleepingComputer
- CS2: falha em mapas da oficina permite roubo de inventário — The Clutch
- CS2 players' in-game chat logs are now being exposed publicly — Dexerto
- Counter-Strike 2 Update, September 9, 2026 — Steam Community
