Skip to content

fix(core): patch pickup duplication exploit and secure chardel command - #1908

Merged
N0tNvll merged 1 commit into
esx-framework:v1.16.0from
voidvalue-dev:fix.1
Oct 6, 2026
Merged

N0tNvll merged 1 commit into
esx-framework:v1.16.0from
voidvalue-dev:fix.1

Conversation

@voidvalue-dev

Copy link
Copy Markdown

Summary of Changes

  1. es_extended (pickup.lua):

    • Added tonumber() sanitization for pickupId.
    • Introduced an immediate claimed lock flag when a pickup request is processed.
    • Added rollback handling to unclaim the pickup if the player cannot carry the item or already owns the weapon, preventing item duplication via race conditions.
  2. esx_identity (main.lua):

    • Changed /chardel command permission level from user to admin to ensure regular players cannot delete characters when debug commands are enabled.

@N0tNvll
N0tNvll self-requested a review October 6, 2026 00:25
@N0tNvll
N0tNvll merged commit a9c2a65 into esx-framework:v1.16.0 Oct 6, 2026
1 check failed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants