Luanti Arbitrary Code Execution Vulnerability via Sandbox Escape

A vulnerability in Luanti (formerly Minetest) versions 5.0.0 prior to 5.15.2 allows a malicious mod to escape the sandboxed Lua environment, execute arbitrary code, and gain full filesystem access on the user's device. This issue affects server-side mods, async and mapgen, as well as the client-side (CSM) environments. The vulnerability is only exploitable when using LuaJIT.

Impact

Exploitation of this vulnerability allows for arbitrary code execution and unauthorized access to the user's filesystem.

Remediation

Users can upgrade to Luanti version 5.15.2 or newer. Alternatively, on release versions, the issue can be patched without recompiling by adding the line 'getfenv = nil' to 'builtin/init.lua'. However, this workaround may disrupt mods that depend on the 'getfenv' function.