Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Luanti
  • Luanti

No data.

No data.

References
Link Providers
https://github.com/luanti-org/luanti/commit/53cef183e2a85a4daff84ac1a9a7946f940da8f8 cve-icon cve-icon
https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557dc896 cve-icon cve-icon
https://github.com/luanti-org/luanti/security/advisories/GHSA-g596-mf82-w8c3 cve-icon cve-icon
History

Thu, 16 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 16 Apr 2026 09:30:00 +0000

Type Values Removed Values Added
Title Lua sandbox escape via crafted module in Luanti using LuaJIT
First Time appeared Luanti
Luanti luanti
Vendors & Products Luanti
Luanti luanti

Thu, 16 Apr 2026 01:15:00 +0000

Type Values Removed Values Added
Description Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.
Weaknesses CWE-829
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-04-16T12:32:04.767Z

Reserved: 2026-04-16T00:51:19.133Z

Link: CVE-2026-40959

cve-icon Vulnrichment

Updated: 2026-04-16T12:22:24.129Z

cve-icon NVD

Status : Received

Published: 2026-04-16T01:16:11.617

Modified: 2026-04-16T01:16:11.617

Link: CVE-2026-40959

cve-icon Redhat

No data.