Summary
It was discovered that Luanti, when using LuaJIT, did not properly
enforce Lua sandbox restrictions. An attacker could possibly use
this issue to execute arbitrary code. (CVE-2026-40959)
It was discovered that Luanti did not properly restrict access to
insecure environments. An attacker could possibly use this issue to
obtain unintended access to the insecure environment or HTTP API.
(CVE-2026-40960)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 25.10 | luanti | 5.10.0+dfsg-5+deb13u1build0.25.10.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | luanti | 5.10.0+dfsg-5+deb13u1build0.26.04.1 |
Vulnerabilities 2
-
Critical 9.3
Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.
-
High 8.1
Luanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. If at least one mod is listed as …