{"id":"CVE-2022-35978","aliases":["DEBIAN-CVE-2022-35978","EUVD-2022-38805","GHSA-663q-pcjw-27cc","MGASA-2023-0005","UBUNTU-CVE-2022-35978","openSUSE-SU-2023:0001-1","openSUSE-SU-2024:12284-1","openSUSE-SU-2025:14825-1"],"status":"published","title":"Lua sandbox escape from mod in Minetest","description":"Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03082,"percentile":0.87781,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-693"],"published":"2022-08-15T19:05:11Z","modified":"2026-11-04T20:01:50Z","exploits":[{"source":"pocgithub","id":"CanVo/CVE-2022-35978-POC","title":"CanVo/CVE-2022-35978-POC","date":"2025-02-27","url":"https://github.com/CanVo/CVE-2022-35978-POC"}],"fixes":[{"ecosystem":"Debian:12","package":"minetest","fixed_in":["5.5.0+dfsg+~1.9.0mt4+dfsg-2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"minetest","fixed_in":["5.6.1-1.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"minetest","fixed_in":["5.6.0-bp154.2.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"minetest","fixed_in":["5.6.0-bp154.2.3.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"minetest","fixed_in":["5.6.0-bp154.2.3.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"minetest","fixed_in":["5.6.0-bp154.2.3.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"luanti","fixed_in":["5.11.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"minetest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0+dfsg+~1.9.0mt4+dfsg-2"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"minetest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"minetest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.12+repack-2ubuntu1","0.4.13+repack-1","0.4.13+repack-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"minetest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.16+repack-3","0.4.16+repack-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"minetest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.1+repack-2","5.1.0+repack-1","5.1.1+repack-1","5.1.1+repack-1build1","5.1.1+repack-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"minetest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0+repack-2.1","5.4.1+repack-2","5.4.1+repack-2build1","5.4.1+repack-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"minetest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.0-bp154.2.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"minetest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.0-bp154.2.3.5"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"minetest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.0-bp154.2.3.5"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"minetest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.0-bp154.2.3.5"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"luanti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.0-1.1"}]}]}],"products":[{"vendor":"minetest","product":"minetest"}],"references":[{"url":"https://github.com/minetest/minetest/security/advisories/GHSA-663q-pcjw-27cc","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/minetest/minetest/commit/da71e86633d0b27cd02d7aac9fdac625d141ca13","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://dev.minetest.net/Changelog#5.5.0_.E2.86.92_5.6.0","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","web","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35978.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35978","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-35978","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0005.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31363","tags":["report"]},{"url":"https://blog.minetest.net/2022/08/04/5.6.0-released/","tags":["web"]},{"url":"https://dev.minetest.net/Changelog#5.4.0_.E2.86.92_5.5.0","tags":["web"]},{"url":"https://dev.minetest.net/Changelog#5.6.0_.E2.86.92_5.6.1","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-35978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-35978","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6BEL53A6YRA752TFXGECQDT4XJ7UK6P5/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1193141","tags":["report"]},{"url":"https://bugzilla.suse.com/1202423","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35978","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Z3ZK4G6DNQFIACTL2C265VGZDQPXSRAZ/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-35978","title":"Lua sandbox escape from mod in Minetest","description":"Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.","status":"published","published":"2022-08-15T19:05:11Z","modified":"2025-04-23T17:50:19.948Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:34:39.935681Z"}],"euvd":[{"id":"EUVD-2022-38805","description":"Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.","status":"published","published":"2022-08-15T19:05:11Z","modified":"2025-04-23T17:50:19Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T20:52:10.363195Z"}],"nvd":[{"id":"CVE-2022-35978","description":"Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.","status":"published","published":"2022-08-15T19:15:08.89Z","modified":"2026-06-17T04:52:38.503Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:07:25.242752Z"}],"osv":[{"id":"CVE-2022-35978","title":"Lua sandbox escape from mod in Minetest","description":"Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.","status":"published","published":"2022-08-15T19:05:11Z","modified":"2026-10-28T10:27:08.570626493Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"UBUNTU-CVE-2022-35978","description":"Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.","status":"published","published":"2022-08-15T19:15:00Z","modified":"2026-11-04T20:01:50.875416418Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L","level":"high"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-06T14:22:05.843011Z"},{"id":"DEBIAN-CVE-2022-35978","description":"Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.","status":"published","published":"2022-08-15T19:15:08.89Z","modified":"2026-11-03T06:02:55.704383154Z","updated_at":"2026-11-03T06:43:19.563245Z"},{"id":"MGASA-2023-0005","title":"Updated minetest packages fix security vulnerability","description":"This update provides minetest 5.6.1, the latest stable release of the open\nsource voxel game. This updates provides a number of feature and bug fix\nchanges compared to the previous version 5.4.0 provided in Mageia 8. See\nthe linked release notes and changelogs for details.\n\nThe update also improves compatibility with hosted game servers, which\ntypically run and expect the latest stable release.\n\nThe update also fixes a security vulnerability affecting single player\nwith malicious mods (GHSA-663q-pcjw-27cc)\n\nIn single player, a mod could set a global setting that controls the Lua\nscript loaded to display the main menu. The script would be loaded as soon\nas the game session is exited. The Lua environment the menu runs in was\nnot sandboxed and could directly  interfere with the user's system.\n(CVE-2022-35978)\n","status":"published","published":"2023-01-13T17:37:09Z","modified":"2026-04-16T04:43:13.512983383Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2023:0001-1","title":"Security update for minetest","description":"This update for minetest fixes the following issues:\n\nUpdate to version 5.6.0\n\n  * Fix CVE-2022-35978 ( boo#1202423 ): Mod scripts can escape sandbox in single player mode\n  * `name` in game.conf is deprecated for the game title, use `title` instead\n  * Add depth sorting for node faces\n  * Various bug fixes\n  * Full changes: https://dev.minetest.net/Changelog#5.5.0_.E2.86.92_5.6.0\n\n- Introduced mbranch-protection=none CXX flag to resolve boo#1193141\n  (aarch64).\n\nUpdate to version 5.5.0 \u0026 5.5.1:\n\n  * Full log for version 5.5.0: https://dev.minetest.net/Changelog#5.4.0_.E2.86.92_5.5.0\n  * This release switches from Irrlicht to our own fork called IrrlichtMt.\n  * Full log for version 5.5.1: https://dev.minetest.net/Changelog#5.5.0_.E2.86.92_5.5.1\n  * This is a maintenance release based on 5.5.0, it contains bugfixes but no new features.\n\n- Added hardening to systemd service(s) (boo#1181400). \n\n- Update to version 5.4.1:\n  * This is a maintenance release based on 5.4.0,\n    it contains bugfixes but no new features.\n\n- Update to version 5.4.0\n  * Full log: https://dev.minetest.net/Changelog#5.3.0_.E2.86.92_5.4.0\n  * Removed support for bumpmapping, generated normal maps\n    and parallax occlusion\n  * By default, the crosshair will now change to an 'X' when\n    pointing to objects\n  * Prevent players accessing inventories of other players\n  * Prevent interacting with items out of the hotbar\n  * Prevent players from being able to modify ItemStack meta\n\n- Update to version 5.3.0. \n  (see https://dev.minetest.net/Changelog#5.2.0_.E2.86.92_5.3.0)\n  * Formspec improvements, including a scrolling GUI element\n  * Performance improvements to the Server and API\n  * Many bug fixes and small features\n- Now requires desktop-file-utils version \u003e= 0.25.\n","status":"published","published":"2023-01-03T09:15:50Z","modified":"2026-02-04T02:54:27.311104Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12284-1","title":"minetest-5.6.0-1.1 on GA media","description":"These are all security issues fixed in the minetest-5.6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:31:48.203478Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2025:14825-1","title":"luanti-5.11.0-1.1 on GA media","description":"These are all security issues fixed in the luanti-5.11.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-20T00:00:00Z","modified":"2026-02-04T03:46:16.258295Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}