Description
Luanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. If at least one mod is listed as secure.trusted_mods or secure.http_mods, then a crafted mod can intercept the request for the insecure environment or HTTP API, and also receive access to it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Luanti | Luanti | 5.0.0 – < 5.15.2 | 5.15.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | luanti | 5.15.2+dfsg-1 | — |
| Debian 13 | luanti | 5.10.0+dfsg-5+deb13u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | luanti | 5.10.0+dfsg-5+deb13u1build0.26.04.1 | USN-8366-1 |
| Ubuntu 25.10 | luanti | 5.10.0+dfsg-5+deb13u1build0.25.10.1 | USN-8366-1 |
Advisories 1
- USN-8366-1 luanti vulnerabilities Ubuntu Security Notices (USN) · Jun 2, 2026