Luanti LuaJIT Sandbox Escape Vulnerability

A vulnerability in Luanti versions 5.0.0 prior to 5.15.2, when using LuaJIT, allows a crafted mod to escape a Lua sandbox. This escape can lead to the execution of arbitrary code and unrestricted access to the filesystem on the user's device. The issue affects both server-side and client-side environments.

Impact

Exploitation of this vulnerability allows for a complete escape from the Lua sandbox, enabling the execution of arbitrary code and full access to the filesystem on the user's device.

Remediation

Users can update to Luanti version 5.15.2 or newer to address this vulnerability. Alternatively, on release versions, the issue can be patched without recompiling by editing 'builtin/init.lua' to remove the 'getfenv' function, though this may break some mods that rely on it.