Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Luanti can let a bad mod run any code on your computer

CVE-2026-40959 · published 6 months ago
Summary

Versions of the Luanti game platform from 5.0.0 up to 5.15.1 let a malicious add‑on break out of its safe sandbox and access the whole file system. This risk exists for both server and client add‑ons when LuaJIT is used. Upgrade to version 5.15.2 or edit the file builtin/init.lua to disable the vulnerable function.

Original advisory text
Luanti has a mod security sandbox escape
Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments. This vulnerability is only exploitable when using LuaJIT. Version 5.15.2 contains a patch. On release versions, one can also patch this issue without recompiling by editing `builtin/init.lua` and adding the line `getfenv = nil` at the end. Note that this will break mods relying on this function (which is not inherently unsafe).
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-829Inclusion of Functionality from Untrusted Control Sphere
CWE-94Code Injection
Timeline
Published23 Apr 2026
Updated4 Nov 2026
First seen16 Apr 2026
Sources
CVE-2026-40959 · NVD
CVE-2026-41196 · OSV
GHSA-g596-mf82-w8c3 · GHSA
CVE-2026-40959 · OSV
Track software like this
Free during beta