Description
Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| minetest | minetest | <= 5.5.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | minetest | 5.5.0+dfsg+~1.9.0mt4+dfsg-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | minetest | No fix yet | — |
| Ubuntu 16.04 LTS | minetest | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | minetest | No fix yet | — |
| Ubuntu Pro 20.04 LTS | minetest | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP4 | minetest | 5.6.0-bp154.2.3.5 | openSUSE-SU-2023:0001-1 |
| SUSE Package Hub 15 SP3 | minetest | 5.6.0-bp154.2.3.5 | openSUSE-SU-2023:0001-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | luanti | 5.11.0-1.1 | openSUSE-SU-2025:14825-1 |
| openSUSE Leap 15.4 | minetest | 5.6.0-bp154.2.3.5 | openSUSE-SU-2023:0001-1 |
| openSUSE Leap 15.3 | minetest | 5.6.0-bp154.2.3.5 | openSUSE-SU-2023:0001-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
CanVo/CVE-2022-35978-POC ★ 0 · Feb 27, 2025
Proof of concept created for CVE-2022-35978 for educational purposes only.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- openSUSE-SU-2025:14825-1 luanti-5.11.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2023:0001-1 Security update for minetest SUSE / openSUSE Security Updates · Feb 4, 2026