Every version of Scratch is vulnerable to arbitrary code execution

Update May 21, 2026: The vulnerability was fixed on the website a bit ago. They also released v3.32.0 of Scratch Desktop, which is intended to fix this bug. Update May 6, 2026: Scratch expanded their server-side filtering to hopefully prevent uploading new malicious projects to the Scratch website, with more permanent fixes in various stages of development. No fix is available for Scratch Desktop…