Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.0
CVE-2026-41196: Luanti and Minetest allow malicious mods to run any code
CVE-2026-41196 · published 6 months ago
Summary
Versions 5.0.0 through 5.15.1 of Luanti (formerly Minetest) let a badly designed game add‑on break out of its safe sandbox and execute any program on the computer. This can give an attacker full access to the user's files. Update to version 5.15.2, or edit the file builtin/init.lua to add "getfenv = nil" as a temporary workaround.
What to do
- Update debian luanti to version 5.10.0+dfsg-5+deb13u1.
- Update debian luanti to version 5.15.2+dfsg-1.
- Update canonical luanti to version 5.10.0+dfsg-5+deb13u1build0.26.04.1.
- Update minetest minetest to version 5.15.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | luanti |
< 5.10.0+dfsg-5+deb13u1 Fix: upgrade to 5.10.0+dfsg-5+deb13u1
|
| Debian:14 | debian | luanti |
< 5.15.2+dfsg-1 Fix: upgrade to 5.15.2+dfsg-1
|
| – | minetest | minetest |
>= 5.0.0, < 5.15.2 cpe:2.3:a:minetest:minetest:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | minetest | All versions |
| Ubuntu:18.04:LTS | canonical | minetest | All versions |
| Ubuntu:20.04:LTS | canonical | minetest | All versions |
| Ubuntu:22.04:LTS | canonical | minetest | All versions |
| Ubuntu:24.04:LTS | canonical | minetest | All versions |
| Ubuntu:25.10 | canonical | luanti | All versions |
| Ubuntu:26.04:LTS | canonical | luanti |
< 5.10.0+dfsg-5+deb13u1build0.26.04.1 Fix: upgrade to 5.10.0+dfsg-5+deb13u1build0.26.04.1
|
Original advisory text
Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment ...
Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments. This vulnerability is only exploitable when using LuaJIT. Version 5.15.2 contains a patch. On release versions, one can also patch this issue without recompiling by editing `builtin/init.lua` and adding the line `getfenv = nil` at the end. Note that this will break mods relying on this function (which is not inherently unsafe).
References
- https://security-tracker.debian.org/tracker/CVE-2026-41196 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-41196 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-41196 Third Party Advisory
- https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557d... Patch
- https://github.com/luanti-org/luanti/security/advisories/GHSA-g596-mf82-w8c3 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-94Code Injection
Timeline
Published23 Apr 2026
Updated4 Nov 2026
First seen23 Apr 2026
Track software like this
Free during beta