diff --git a/src/user/user_model.cc b/src/user/user_model.cc
index a4f5a2dd..0b1e357a 100644
--- a/src/user/user_model.cc
+++ b/src/user/user_model.cc
@@ -17,6 +17,7 @@
 #include <algorithm>
 #include <csetjmp>
 #include <cstddef>
+#include <cstdint>
 #include <cstdlib>
 #include <cstring>
 #include <map>
@@ -27,6 +28,7 @@
 #include <mujoco/mjdata.h>
 #include <mujoco/mjmacro.h>
 #include <mujoco/mjmodel.h>
+#include <mujoco/mjtnum.h>
 #include <mujoco/mjplugin.h>
 #include <mujoco/mjvisualize.h>
 #include "cc/array_safety.h"
@@ -1087,7 +1089,7 @@ void mjCModel::LengthRange(mjModel* m, mjData* data) {
     char err[200];
     for (int i=0; i<m->nu; i++) {
       if (!mj_setLengthRange(m, data, i, &LRopt, err, 200)) {
-        throw mjCError(0, err);
+        throw mjCError(0, "%s", err);
       }
     }
   }
@@ -1150,7 +1152,7 @@ void mjCModel::LengthRange(mjModel* m, mjData* data) {
     // report first error
     for (int i=0; i<nthread; i++) {
       if (err[i][0]) {
-        throw mjCError(0, err[i]);
+        throw mjCError(0, "%s", err[i]);
       }
     }
   }
@@ -2564,7 +2566,7 @@ static void processlist(mjListKeyMap& ids, vector<T*>& list,
       auto adjacent = std::adjacent_find(allnames.begin(), allnames.end());
       if (adjacent != allnames.end()) {
         string msg = "repeated name '" + *adjacent + "' in " + mju_type2Str(type);
-        throw mjCError(NULL, msg.c_str());
+        throw mjCError(NULL, "%s", msg.c_str());
       }
     }
   }
@@ -3052,7 +3054,7 @@ void mjCModel::TryCompile(mjModel*& m, mjData*& d, const mjVFS* vfs) {
   if (validationerr) {  // SHOULD NOT OCCUR
     mj_deleteData(d);
     mj_deleteModel(m);
-    throw mjCError(0, validationerr);
+    throw mjCError(0, "%s", validationerr);
   }
 
   // delete partial mjData (no plugins), make a complete one
diff --git a/src/user/user_objects.cc b/src/user/user_objects.cc
index 84a9c8c8..b503778f 100644
--- a/src/user/user_objects.cc
+++ b/src/user/user_objects.cc
@@ -4732,6 +4732,6 @@ void mjCPlugin::Compile(void) {
     std::string error =
         "unrecognized attribute 'plugin:" + config_attribs.begin()->first +
         "' for plugin " + std::string(plugin->name) + "'";
-    throw mjCError(parent, error.c_str());
+    throw mjCError(parent, "%s", error.c_str());
   }
 }
diff --git a/src/xml/xml_native_reader.cc b/src/xml/xml_native_reader.cc
index 57671db9..7863afaa 100644
--- a/src/xml/xml_native_reader.cc
+++ b/src/xml/xml_native_reader.cc
@@ -57,7 +57,7 @@ void ReadPluginConfigs(tinyxml2::XMLElement* elem, mjCPlugin* pp) {
       mjXUtil::ReadAttrTxt(child, "key", key, /* required = */ true);
       if (config_attribs.find(key) != config_attribs.end()) {
         std::string err = "duplicate config key: " + key;
-        throw mjXError(child, err.c_str());
+        throw mjXError(child, "%s", err.c_str());
       }
       mjXUtil::ReadAttrTxt(child, "value", value, /* required = */ true);
       config_attribs[key] = value;
@@ -1117,7 +1117,7 @@ void mjXReader::Size(XMLElement* section, mjCModel* mod) {
         std::string trailing;
         strm >> trailing;
         if (!trailing.empty() || !strm.eof()) {
-          throw mjXError(section, err_msg);
+          throw mjXError(section, "%s", err_msg);
         }
 
         // allow explicit specification of the default "-1" value
@@ -1130,14 +1130,14 @@ void mjXReader::Size(XMLElement* section, mjCModel* mod) {
 
       // check that the number is not negative
       if (strm.peek() == '-') {
-        throw mjXError(section, err_msg);
+        throw mjXError(section, "%s", err_msg);
       }
 
       std::size_t base_size;
       strm >> base_size;
       if (strm.fail()) {
         // either not an integer or the number without the suffix is already bigger than size_t
-        throw mjXError(section, err_msg);
+        throw mjXError(section, "%s", err_msg);
       }
 
       // parse the multiplier suffix
@@ -1161,20 +1161,20 @@ void mjXReader::Size(XMLElement* section, mjCModel* mod) {
         // check for invalid suffix, or suffix longer than one character
         strm.get();
         if (!multiplier_bit || !strm.eof()) {
-          throw mjXError(section, err_msg);
+          throw mjXError(section, "%s", err_msg);
         }
       }
 
       // check that the specified suffix isn't bigger than size_t
       if (multiplier_bit + 1 > std::numeric_limits<std::size_t>::digits) {
-        throw mjXError(section, err_msg);
+        throw mjXError(section, "%s", err_msg);
       }
 
       // check that the suffix won't take the total size beyond size_t
       const std::size_t max_base_size =
           (std::numeric_limits<std::size_t>::max() << multiplier_bit) >> multiplier_bit;
       if (base_size > max_base_size) {
-        throw mjXError(section, err_msg);
+        throw mjXError(section, "%s", err_msg);
       }
 
       const std::size_t total_size = base_size << multiplier_bit;
@@ -1183,7 +1183,7 @@ void mjXReader::Size(XMLElement* section, mjCModel* mod) {
 
     if (memory.has_value()) {
       if (*memory / sizeof(mjtNum) > std::numeric_limits<int>::max()) {
-        throw mjXError(section, err_msg);
+        throw mjXError(section, "%s", err_msg);
       }
       mod->memory = *memory;
     }
@@ -2183,7 +2183,7 @@ void mjXReader::OneComposite(XMLElement* elem, mjCBody* pbody, mjCDef* def) {
     if (comp.add[kind]) {
       char error[200];
       if (!comp.AddDefaultJoint(error, 200)) {
-        throw mjXError(elem, error);
+        throw mjXError(elem, "%s", error);
       }
     }
     comp.add[kind] = true;
@@ -2276,7 +2276,7 @@ void mjXReader::OneComposite(XMLElement* elem, mjCBody* pbody, mjCDef* def) {
 
   // throw error
   if (!res) {
-    throw mjXError(elem, error);
+    throw mjXError(elem, "%s", error);
   }
 }
 
@@ -2408,7 +2408,7 @@ void mjXReader::OneFlexcomp(XMLElement* elem, mjCBody* pbody) {
 
   // throw error
   if (!res) {
-    throw mjXError(elem, error);
+    throw mjXError(elem, "%s", error);
   }
 }