# Vulnerability of Magik.net **URL:** \ **Category:** Pipeline & Plugins\ **Tags:** unreal-engine, Epic-Pro-Support, question\ **Created:** [July 24, 2025, 4:57pm UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266 "2025-07-24T16:57:06Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![anonymous-edc](https://d3kjluh73b9h9o.cloudfront.net/original/4X/2/8/5/28502927f1d97ba1051b3b47ccfe17233bf41ef0.png) [@anonymous-edc](https://forums.unrealengine.com/u/anonymous-edc)\ **Post date:** [July 24, 2025, 4:57pm UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/1 "2025-07-24T16:57:06Z")
Hello! Since yesterday we have these warnings : `Warning As Error: Package 'Magick.NET-Q16-HDRI-AnyCPU' 14.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-vmhh-8rxq-fp9g [D:\jwrk\p11\workspace\p11-staging-main\J\Engine\Source\Programs\Shared\EpicGames.ScriptBuild\EpicGames.ScriptBuild.csproj] [dotnet build] ***\J\Engine\Source\Programs\AutomationTool\Gauntlet\Gauntlet.Automation.csproj : error NU1903: Warning As Error: Package 'Magick.NET-Q16-HDRI-AnyCPU' 14.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-vmhh-8rxq-fp9g [***\J\Engine\Source\Programs\Shared\EpicGames.ScriptBuild\EpicGames.ScriptBuild.csproj] [dotnet build] Build FAILED. [dotnet build] ***\J\Engine\Source\Programs\AutomationTool\AutomationUtils\AutomationUtils.Automation.csproj : error NU1903: Warning As Error: Package 'Magick.NET-Q16-HDRI-AnyCPU' 14.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-vmhh-8rxq-fp9g [***\J\Engine\Source\Programs\Shared\EpicGames.ScriptBuild\EpicGames.ScriptBuild.csproj] [dotnet build] ***\J\Engine\Source\Programs\AutomationTool\Gauntlet\Gauntlet.Automation.csproj : error NU1903: Warning As Error: Package 'Magick.NET-Q16-HDRI-AnyCPU' 14.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-vmhh-8rxq-fp9g [***\J\Engine\Source\Programs\Shared\EpicGames.ScriptBuild\EpicGames.ScriptBuild.csproj]`I updated : /Engine/Source/Programs/AutomationTool/AutomationTool.csproj /Engine/Source/Programs/AutomationTool/AutomationUtils/AutomationUtils.Automation.csproj /Engine/Source/Programs/AutomationTool/Gauntlet/Gauntlet.Automation.csproj To use [Magik.net](http://Magik.net) 14.7 Is it something that you are going to do to prevent thse warnings? Thanks! ---
**Author:** ![anonymous-edc](https://d3kjluh73b9h9o.cloudfront.net/original/4X/2/8/5/28502927f1d97ba1051b3b47ccfe17233bf41ef0.png) [@anonymous-edc](https://forums.unrealengine.com/u/anonymous-edc)\ **Post date:** [July 24, 2025, 4:57pm UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/2 "2025-07-24T16:57:10Z")
**Steps to Reproduce** Compile the 5.6.0 engine ---
**Author:** ![Patrick\_Laflamme](https://d1ap1mz92jnks1.cloudfront.net/user_avatar/forums.unrealengine.com/patrick_laflamme/32/1036111_2.png) [@Patrick\_Laflamme](https://forums.unrealengine.com/u/Patrick_Laflamme)\ **Post date:** [July 24, 2025, 5:26pm UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/3 "2025-07-24T17:26:23Z")
Hi, Thanks for reporting, we also upgraded it today, CL 44305997 ([https://github.com/EpicGames/UnrealEngine/commit/a967190c4caee9dedc834d89f3c322cc356d6f30\](https://github.com/EpicGames/UnrealEngine/commit/a967190c4caee9dedc834d89f3c322cc356d6f30%5C)) on UE5/Main and it was merged to UE 5.6 at CL 44311406. You can probably keep your fix as it looks like the one we did. Regards, Patrick ---
**Author:** ![anonymous-edc](https://d3kjluh73b9h9o.cloudfront.net/original/4X/2/8/5/28502927f1d97ba1051b3b47ccfe17233bf41ef0.png) [@anonymous-edc](https://forums.unrealengine.com/u/anonymous-edc)\ **Post date:** [July 24, 2025, 5:35pm UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/4 "2025-07-24T17:35:34Z")
Thanks a lot [mention removed]​ for the quick answer and the quick fix! WIll it be integrated in 5.6.1? ---
**Author:** ![Patrick\_Laflamme](https://d1ap1mz92jnks1.cloudfront.net/user_avatar/forums.unrealengine.com/patrick_laflamme/32/1036111_2.png) [@Patrick\_Laflamme](https://forums.unrealengine.com/u/Patrick_Laflamme)\ **Post date:** [July 24, 2025, 5:37pm UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/5 "2025-07-24T17:37:55Z")
Yes, it will be part of 5.6.1. ---
**Author:** ![anonymous-edc](https://d3kjluh73b9h9o.cloudfront.net/original/4X/2/8/5/28502927f1d97ba1051b3b47ccfe17233bf41ef0.png) [@anonymous-edc](https://forums.unrealengine.com/u/anonymous-edc)\ **Post date:** [July 24, 2025, 5:42pm UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/6 "2025-07-24T17:42:22Z")
Thanks again! Do you know or can you say when 5.6.1 will be released? (I integrated your fix to have the same as you have) ---
**Author:** ![Patrick\_Laflamme](https://d1ap1mz92jnks1.cloudfront.net/user_avatar/forums.unrealengine.com/patrick_laflamme/32/1036111_2.png) [@Patrick\_Laflamme](https://forums.unrealengine.com/u/Patrick_Laflamme)\ **Post date:** [July 24, 2025, 5:57pm UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/7 "2025-07-24T17:57:21Z")
The 5.6.1 is scheduled to be out somewhere in middle of August 2025. Sometime the date shifts, but that’s what I know today. ---
**Author:** ![anonymous-edc](https://d3kjluh73b9h9o.cloudfront.net/original/4X/2/8/5/28502927f1d97ba1051b3b47ccfe17233bf41ef0.png) [@anonymous-edc](https://forums.unrealengine.com/u/anonymous-edc)\ **Post date:** [July 24, 2025, 6:01pm UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/8 "2025-07-24T18:01:26Z")
Thanks a lot! Much appreciated! You can close the case! ---
**Author:** ![Moddtoulder](https://d3kjluh73b9h9o.cloudfront.net/original/4X/2/8/5/28502927f1d97ba1051b3b47ccfe17233bf41ef0.png) [@Moddtoulder](https://forums.unrealengine.com/u/Moddtoulder)\ **Post date:** [August 26, 2025, 2:00pm UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/9 "2025-08-26T14:00:26Z")
Had to bump to 14.8 on 5.6.1: [ImageMagick has Undefined Behavior (function-type-mismatch) in CloneSplayTree · CVE-2025-55160 · GitHub Advisory Database · GitHub](https://github.com/advisories/GHSA-6hgw-6x87-578x) ---
**Author:** ![saurabhs](https://d1ap1mz92jnks1.cloudfront.net/user_avatar/forums.unrealengine.com/saurabhs/32/88719_2.png) [@saurabhs](https://forums.unrealengine.com/u/saurabhs)\ **Post date:** [August 30, 2025, 8:45am UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/10 "2025-08-30T08:45:53Z")
MagickNET 14.8.0 also has high severity ([CVE](https://github.com/advisories/GHSA-mxvv-97wh-cfmm)), 14.8.1 works ---
**Author:** ![spvnn](https://d3kjluh73b9h9o.cloudfront.net/original/4X/2/8/5/28502927f1d97ba1051b3b47ccfe17233bf41ef0.png) [@spvnn](https://forums.unrealengine.com/u/spvnn)\ **Post date:** [September 11, 2025, 2:37am UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/11 "2025-09-11T02:37:36Z")
How do I bump up the version of this dependency? EDIT: Nevermind found the knowledge base article: > **[Tech Note: Errors when compiling the Unreal Automation Tool in 5.6 |...](https://dev.epicgames.com/community/learning/knowledge-base/DBLR/unreal-engine-tech-note-errors-when-compiling-the-unreal-automation-tool-in-5-6)** > > We have identified errors when compiling the UAT and have found a solution. ---
**Author:** ![Dayaern](https://d3kjluh73b9h9o.cloudfront.net/original/4X/2/8/5/28502927f1d97ba1051b3b47ccfe17233bf41ef0.png) [@Dayaern](https://forums.unrealengine.com/u/Dayaern)\ **Post date:** [October 24, 2025, 8:29am UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/12 "2025-10-24T08:29:21Z")
Updating the affected components to 14.8.1 (inside NuGet package manager of VS Studio) fixed it for me. Much appreciated. ---
**Author:** ![Kirsten](https://d3kjluh73b9h9o.cloudfront.net/original/4X/2/8/5/28502927f1d97ba1051b3b47ccfe17233bf41ef0.png) [@Kirsten](https://forums.unrealengine.com/u/Kirsten)\ **Post date:** [October 31, 2025, 9:01am UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/13 "2025-10-31T09:01:06Z")
Above worked for us until now. We get the same issue with 14.8.1 `error NU1902: Warning As Error: Package 'Magick.NET-Q16-HDRI-AnyCPU' 14.8.1 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-9pp9-cfwx-54rm ` `[…\Engine\Saved\CsTools\Engine\Source\Programs\AutomationTool\Android\Android.Automation.csproj]` edit: I bumped the version to 14.9.1 and it works again ---
**Author:** ![Satcom\_Goose](https://d3kjluh73b9h9o.cloudfront.net/original/4X/2/8/5/28502927f1d97ba1051b3b47ccfe17233bf41ef0.png) [@Satcom\_Goose](https://forums.unrealengine.com/u/Satcom_Goose)\ **Post date:** [November 2, 2025, 10:48am UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/14 "2025-11-02T10:48:44Z")
Is this not merged into 5.6.1? I still get the old 14.7.0 version during a clean git clone and build for UE5.6.1 ---
**Author:** ![BigBoss3.0.1](https://d3kjluh73b9h9o.cloudfront.net/original/4X/2/8/5/28502927f1d97ba1051b3b47ccfe17233bf41ef0.png) [@BigBoss3.0.1](https://forums.unrealengine.com/u/BigBoss3.0.1)\ **Post date:** [December 26, 2025, 4:35pm UTC](https://forums.unrealengine.com/t/vulnerability-of-magik-net/2650266/15 "2025-12-26T16:35:14Z")
Same for me; i.e., a few months ago, I built 5.6.1 from source, and that release is still referencing `Magick.NET-Q16-HDRI-AnyCPU` version 14.7.0. I solved the issue by disabling the warnings inside the `PackageReference` tags in `AutomationTool.csproj`, `AutomationUtils.Automation.csproj`, and `Gauntlet.Automation.csproj`; i.e., respectively, I used: ```auto $(NoWarn);NU1901;NU1902;NU1903 ``` ```auto $(NoWarn);NU1901;NU1902;NU1903 ``` and ```auto $(NoWarn);NU1901;NU1902;NU1903 ``` Obviously, that’s not ideal because we are now only ignoring the vulnerability, but it does the trick if the goal is to continue using that package version.