CVE-2026-40959
9.3 CRITICALLuanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod
Published: 2026-04-16 · Last updated: 2026-05-19
Severity and scoring
- CVSS
- 9.3 CRITICAL
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CWE
- CWE-829
Description
Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-40959
- [Other]https://github.com/luanti-org/luanti/commit/53cef183e2a85a4daff84ac1a9a7946f940da8f8
- [Other]https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557dc896
- [Other]https://github.com/luanti-org/luanti/security/advisories/GHSA-g596-mf82-w8c3
Related CVEs
Same CWE
- CVE-2026-53810 — OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading towar... (8.8 HIGH)
- CVE-2026-52858 — Vim is an open source, command line text editor
- CVE-2026-47174 — In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes
- CVE-2026-47172 — Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support
- CVE-2026-46529 — Atril Document Viewer is the default document reader of the MATE desktop environment for Linux