CVE-2026-40959

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

9.3 CriticalFix available

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.18%Up 0.2 points since Apr 16, 2026

What each source reports

CVE List Score used 9.3

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

Record: CVE-2026-40959
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-829
Updated: 2026-11-02

EUVDEUVD-2026-23149 9.3

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

Record: EUVD-2026-23149
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wxm2-x9x9-x5mj 9.3

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

Record: GHSA-wxm2-x9x9-x5mj
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-829
Updated: 2026-11-02

NVD 9.3

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

Record: CVE-2026-40959
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-829
Updated: 2026-11-02

OSV 9.3

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

Record: CVE-2026-40959
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-829
Updated: 2026-11-02

OSVCVE-2026-41196 9.0

Luanti has a mod security sandbox escape

Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments. This vulnerability is only exploitable when using LuaJIT. Version 5.15.2 contains a patch. On release versions, one can also patch this issue without recompiling by editing builtin/init.lua and adding the line getfenv = nil at the end. Note that this will break mods relying on this function (which is not inherently unsafe).

Record: CVE-2026-41196
CVSS 4.0: 9.0 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness: CWE-94
Updated: 2026-11-02

Show 4 moreShow less

OSVDEBIAN-CVE-2026-40959 9.3

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

Record: DEBIAN-CVE-2026-40959
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-40959 9.3

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

Record: UBUNTU-CVE-2026-40959
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2026-0185 No score

Updated minetest packages fix security vulnerabilities

Mod security sandbox escape. (CVE-2026-40959) HTTP API and insecure environment access control bypass. (CVE-2026-40960)

Record: MGASA-2026-0185
Updated: 2026-11-02

OSVUSN-8366-1 No score

luanti vulnerabilities

It was discovered that Luanti, when using LuaJIT, did not properly enforce Lua sandbox restrictions. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-40959)

It was discovered that Luanti did not properly restrict access to insecure environments. An attacker could possibly use this issue to obtain unintended access to the insecure environment or HTTP API. (CVE-2026-40960)

Record: USN-8366-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`luanti` Debian:13	before 5.10.0+dfsg-5+deb13u1, plus listed versions 5.10.0+dfsg-5	5.10.0+dfsg-5+deb13u1
`luanti` Debian:14	before 5.15.2+dfsg-1, plus listed versions 5.10.0+dfsg-55.14.0+dfsg-15.14.0+dfsg-25.14.0+dfsg-35.15.1+dfsg-15.15.1+dfsg-2	5.15.2+dfsg-1
`minetest` Mageia:9 From an advisory covering 2 CVEs	before 5.7.0-1.1.mga9	5.7.0-1.1.mga9
`luanti` Ubuntu:25.10	before 5.10.0+dfsg-5+deb13u1build0.25.10.1, plus listed versions 5.10.0+dfsg-5	5.10.0+dfsg-5+deb13u1build0.25.10.1
`luanti` Ubuntu:26.04:LTS	before 5.10.0+dfsg-5+deb13u1build0.26.04.1, plus listed versions 5.10.0+dfsg-5	5.10.0+dfsg-5+deb13u1build0.26.04.1
`luanti` Ubuntu:25.10 From an advisory covering 2 CVEs	before 5.10.0+dfsg-5+deb13u1build0.25.10.1, plus listed versions 5.10.0+dfsg-5	5.10.0+dfsg-5+deb13u1build0.25.10.1
`luanti` Ubuntu:26.04:LTS From an advisory covering 2 CVEs	before 5.10.0+dfsg-5+deb13u1build0.26.04.1, plus listed versions 5.10.0+dfsg-5	5.10.0+dfsg-5+deb13u1build0.26.04.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40959 is a critical vulnerability (CVSS 9.3) in Luanti, published April 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in luanti 5.10.0+dfsg-5+deb13u1.

References

Show 12 moreShow less