Skip to content
OpenAdvisories
Critical USN-8732-1 1 CVE

minetest vulnerability

Published Sep 7, 2026 · Updated Sep 8, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Minetest did not properly sanitize the Lua sandbox environment
when using LuaJIT. A malicious mod could escape the sandbox to execute arbitrary code
and gain full file system access on the server. An attacker could use this issue to
compromise the server.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS minetest 5.1.1+repack-1ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS minetest 5.4.1+repack-2ubuntu0.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS minetest 5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1

Vulnerabilities 1

  • Critical 9.0
    CVE-2026-41196

    Luanti has a mod security sandbox escape

    Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on t…

    Luanti Luanti minetest luanti Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2026-41196