Minecraft Java Edition usually runs at user permissions without sandboxing. These permissions carry forward into Java mods - modloaders generally do not attempt

Minecraft Java Edition usually runs at user permissions without sandboxing. These permissions carry forward into Java mods - modloaders generally do not attempt to further lock down mods they load, because that's contrary to the spirit of game modification. So if you get pwned by this, it's game over. All your personal information is compromised and the attacker will be able to remain persistent in all sorts of very banal ways. Most Minecraft servers run in virtual machines. If the server only handles Minecraft then the worst the attacker can do is use the server to run further attacks elsewhere. That will get you a nasty call from your host's abuse desk[0] but that damage can be contained by rebuilding the server from known-good backups[1] and updated versions of the mods you're running. Ironically the one environment that wouldn't be immediately pwnable with this would be Pojav Launcher, which is specifically designed to load Java Edition onto iPads using developer debugging permissions. At worst it'd be a beachhead for further attempts to jailbreak your iPad without your knowledge. But that's generally a little too high risk for "turning kids playing Minceraft into a botnet". [0] If you're lucky, it's the EC2 abuse desk. If you're unlucky, it's the GCP abuse desk. [1] If you don't have backups you MIIIIGHT be able to get away with copying the world file as long as you only ever load it on a patched Minecraft server and there isn't some kind of persistence vuln in the NBT handling code of Minecraft.