CVE-2026-41196 — Luanti has a mod security sandbox escape

Affected: luanti-org luanti

Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments. This vulnerability is only exploitable when using LuaJIT. Version 5.15.2 contains a patch. On release versions, one can also patch this issue without recompiling by editing `builtin/init.lua` and adding the line `getfenv = nil` at the end. Note that this will break mods relying on this function (which is not inherently unsafe).

USN-8732-1 — minetest vulnerability

Affected: Ubuntu:Pro:20.04:LTS: minetest, Ubuntu:Pro:22.04:LTS: minetest, Ubuntu:Pro:24.04:LTS: minetest

It was discovered that Minetest did not properly sanitize the Lua sandbox environment when using LuaJIT. A malicious mod could escape the sandbox to execute arbitrary code and gain full file system access on the server. An attacker could use this issue to compromise the server.

Most recent entries from all

CVE-2026-41196 — Luanti has a mod security sandbox escape

USN-8732-1 — minetest vulnerability