Wave Vulnerabilities

Hey guys, it's been a while since I last used WeAreDevs forums but Roblox exploiting is back..? Despite that though, I had heard that Wave released again, and I had just saw another thread on Reddit mentioning that Wave has the Debug Lib Vulnerabilities found in Synapse back at the end of 2021. Just wanted to ensure people were aware about this as it's kind of concerning the lack of care in user security that they have for a second time in a row..

Vulnerabilities in Wave by u/Objective_Highway424 (Original post if anyone was curious)

Posting this on a throwaway, but I recently purchased Wave, and due to the vulnerabilities previously known in the beta, the first thing I did was look for vulnerabilities. It was very public knowledge back in 2021/2022 about the vulnerabilities that were present in the debug library in Synapse X, which were later patched and a test script for them published. These vulnerabilities can lead to arbitrary code execution, as shown in the reddit thread about them (https://www.reddit.com/r/robloxhackers/comments/rkuga2/most_executors_affected_by_debug_lib_ace/).

Wave is vulnerable to these same vulnerabilities, an oversight I feel should of been corrected prior to release. Wave's claim of 100% UNC also appears to be false, as setscriptable failed, resulting in 99% UNC.

These claims can be validated easily by trying the test script available in the reddit post above (the screenshot is of a slightly modified version doing a warn for each failed test instead of asserts, so they will all be tested)

Image Showing Vulnerabilities (I was planning to use an image, but WRD was breaking for me..)

If anyone was curious, yes Rexi did reply to this.

Rexi's reply:

Stop using old scripts UNC exists for a reason, and also theres UNC but for vulns
loadstring(game:HttpGet("https://raw.githubusercontent.com/fissurectomy/test/main/executor_vuln_test.lua"))()

other than that its not really a vuln but ill check it out.

OP's reply to Rexi:

Just because there is a vulnerability test script (which I did try, and Wave did pass that), does not mean it contains every vulnerability possible. Your blatant denial of this, despite the same lack of checks in the debug library leading to people using synapse being infected with malware before is concerning, and shows that your priorities clearly do not include user security.

Image of Reply (Same thing happened again.. Can't use an image cause WRD was being broken..)