Описание
Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments. This vulnerability is only exploitable when using LuaJIT. Version 5.15.2 contains a patch. On release versions, one can also patch this issue without recompiling by editing builtin/init.lua and adding the line getfenv = nil at the end. Note that this will break mods relying on this function (which is not inherently unsafe).
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 5.10.0+dfsg-5 |
| esm-apps/resolute | released | 5.10.0+dfsg-5+deb13u1build0.26.04.1 |
| jammy | DNE | |
| noble | DNE | |
| questing | ignored | end of life, was needs-triage |
| resolute | released | 5.10.0+dfsg-5+deb13u1build0.26.04.1 |
| stonking | not-affected | 5.10.0+dfsg-5 |
| upstream | released | 5.15.2 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps-legacy/xenial | not-affected | |
| esm-apps/bionic | not-affected | |
| esm-apps/focal | released | 5.1.1+repack-1ubuntu0.1~esm1 |
| esm-apps/jammy | released | 5.4.1+repack-2ubuntu0.1~esm1 |
| esm-apps/noble | released | 5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1 |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| jammy | needed | |
| noble | needed | |
| questing | DNE |
Показывать по
EPSS
10 Critical
CVSS3
Связанные уязвимости
Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments. This vulnerability is only exploitable when using LuaJIT. Version 5.15.2 contains a patch. On release versions, one can also patch this issue without recompiling by editing `builtin/init.lua` and adding the line `getfenv = nil` at the end. Note that this will break mods relying on this function (which is not inherently unsafe).
Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments. This vulnerability is only exploitable when using LuaJIT. Version 5.15.2 contains a patch. On release versions, one can also patch this issue without recompiling by editing `builtin/init.lua` and adding the line `getfenv = nil` at the end. Note that this will break mods relying on this function (which is not inherently unsafe).
Luanti (formerly Minetest) is an open source voxel game-creation platf ...
ALT-PU-2026-20690: package `minetest` update to version 5.18.0-alt1
EPSS
10 Critical
CVSS3