Every CVE Search/ Get API key

CVE-2022-35978

Lua sandbox escape from mod in Minetest

7.7 HighPublic exploitFix available

Minetest is a free open-source voxel game engine with easy modding and game creation. In single player, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
Low

Exploit likelihood

3.08%Up 2.2 points since Aug 16, 2022
90%50%10%1%

What each source reports

CVE List Score used 7.7

Lua sandbox escape from mod in Minetest

Minetest is a free open-source voxel game engine with easy modding and game creation. In single player, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.

Record
CVE-2022-35978
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L
Weakness
CWE-693
Updated
2026-11-02
EUVDEUVD-2022-38805 7.7

Minetest is a free open-source voxel game engine with easy modding and game creation. In single player, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.

Record
EUVD-2022-38805
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L
Updated
2026-11-02
NVD 7.7

Minetest is a free open-source voxel game engine with easy modding and game creation. In single player, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.

Record
CVE-2022-35978
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-693
Updated
2026-11-02
OSV 7.7

Lua sandbox escape from mod in Minetest

Minetest is a free open-source voxel game engine with easy modding and game creation. In single player, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.

Record
CVE-2022-35978
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L
Weakness
CWE-693
Updated
2026-11-02
OSVUBUNTU-CVE-2022-35978 7.7

Minetest is a free open-source voxel game engine with easy modding and game creation. In single player, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.

Record
UBUNTU-CVE-2022-35978
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-06
OSVDEBIAN-CVE-2022-35978 No score

Minetest is a free open-source voxel game engine with easy modding and game creation. In single player, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.

Record
DEBIAN-CVE-2022-35978
Updated
2026-11-03
Show 4 moreShow less
OSVMGASA-2023-0005 No score

Updated minetest packages fix security vulnerability

This update provides minetest 5.6.1, the latest stable release of the open source voxel game. This updates provides a number of feature and bug fix changes compared to the previous version 5.4.0 provided in Mageia 8. See the linked release notes and changelogs for details.

The update also improves compatibility with hosted game servers, which typically run and expect the latest stable release.

The update also fixes a security vulnerability affecting single player with malicious mods (GHSA-663q-pcjw-27cc)

In single player, a mod could set a global setting that controls the Lua script loaded to display the main menu. The script would be loaded as soon as the game session is exited. The Lua environment the menu runs in was not sandboxed and could directly interfere with the user's system. (CVE-2022-35978)

Record
MGASA-2023-0005
Updated
2026-11-02
OSVopenSUSE-SU-2023:0001-1 No score

Security update for minetest

This update for minetest fixes the following issues:

Update to version 5.6.0

  • Fix CVE-2022-35978 ( boo#1202423 ): Mod scripts can escape sandbox in single player mode
  • name in game.conf is deprecated for the game title, use title instead
  • Add depth sorting for node faces
  • Various bug fixes
  • Full changes: https://dev.minetest.net/Changelog#5.5.0_.E2.86.92_5.6.0
  • Introduced mbranch-protection=none CXX flag to resolve boo#1193141 (aarch64).

Update to version 5.5.0 & 5.5.1:

  • Added hardening to systemd service(s) (boo#1181400).

  • Update to version 5.4.1:

    • This is a maintenance release based on 5.4.0, it contains bugfixes but no new features.

  • Update to version 5.4.0

    • Full log: https://dev.minetest.net/Changelog#5.3.0_.E2.86.92_5.4.0
    • Removed support for bumpmapping, generated normal maps and parallax occlusion
    • By default, the crosshair will now change to an 'X' when pointing to objects
    • Prevent players accessing inventories of other players
    • Prevent interacting with items out of the hotbar
    • Prevent players from being able to modify ItemStack meta

  • Update to version 5.3.0. (see https://dev.minetest.net/Changelog#5.2.0_.E2.86.92_5.3.0)

    • Formspec improvements, including a scrolling GUI element
    • Performance improvements to the Server and API
    • Many bug fixes and small features

  • Now requires desktop-file-utils version >= 0.25.

Record
openSUSE-SU-2023:0001-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12284-1 No score

minetest-5.6.0-1.1 on GA media

These are all security issues fixed in the minetest-5.6.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12284-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:14825-1 No score

luanti-5.11.0-1.1 on GA media

These are all security issues fixed in the luanti-5.11.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14825-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
minetest
Debian:12
 before 5.5.0+dfsg+~1.9.0mt4+dfsg-2
5.5.0+dfsg+~1.9.0mt4+dfsg-2
minetest
Mageia:8
 before 5.6.1-1.mga8
5.6.1-1.mga8
minetest
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.4.12+repack-2ubuntu10.4.13+repack-10.4.13+repack-1build1
 None known
minetest
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.4.16+repack-30.4.16+repack-4
 None known
minetest
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.0.1+repack-25.1.0+repack-15.1.1+repack-15.1.1+repack-1build15.1.1+repack-1ubuntu0.1~esm1
 None known
minetest
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.3.0+repack-2.15.4.1+repack-25.4.1+repack-2build15.4.1+repack-2ubuntu0.1~esm1
 None known
minetest
SUSE:Package Hub 15 SP3
 before 5.6.0-bp154.2.3.5
5.6.0-bp154.2.3.5
minetest
SUSE:Package Hub 15 SP4
 before 5.6.0-bp154.2.3.5
5.6.0-bp154.2.3.5
minetest
openSUSE:Leap 15.3
 before 5.6.0-bp154.2.3.5
5.6.0-bp154.2.3.5
minetest
openSUSE:Leap 15.4
 before 5.6.0-bp154.2.3.5
5.6.0-bp154.2.3.5
luanti
openSUSE:Tumbleweed
 before 5.11.0-1.1
5.11.0-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubCanVo/CVE-2022-35978-POC2025-02-27

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-35978 is a high vulnerability (CVSS 7.7) in Minetest, published August 15, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.08%, the 87th percentile. Fixed in minetest 5.5.0+dfsg+~1.9.0mt4+dfsg-2.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open