CVE-2026-41196
luanti: minetest: luajit: Luanti (Minetest): Arbitrary code execution and full filesystem access via malicious mod sandbox escape
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (hoch), Ubuntu (mittel).
Beschreibung
Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments. This vulnerability is only exploitable when using LuaJIT. Version 5.15.2 contains a patch. On release versions, one can also patch this issue without recompiling by editing `builtin/init.lua` and adding the line `getfenv = nil` at the end. Note that this will break mods relying on this function (which is not inherently unsafe).
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 13 | luanti | 5.10.0+dfsg-5+deb13u1 |
| debian 14 | luanti | 5.15.2+dfsg-1 |
| echo | luanti | 5.10.0+dfsg-5+deb13u1 |
| rapidfort alpine 3.20 | minetest | kein Fix angegeben |
| rapidfort alpine 3.21 | minetest | kein Fix angegeben |
| rapidfort alpine 3.22 | minetest | kein Fix angegeben |
| rapidfort alpine 3.23 | minetest | kein Fix angegeben |
| rapidfort alpine 3.24 | minetest | kein Fix angegeben |
| rapidfort fedora 43 | minetest, minetest-data-common, minetest-server | 5.15.2-1.fc43 |
| rapidfort Oracle Linux 9 | minetest, minetest-data-common, minetest-server | kein Fix angegeben |
| rapidfort ubuntu 20.04 | luanti, minetest | 0:5.10.0+dfsg-5+deb13u1build0.26.04.1 und 1 weitere |
| rapidfort ubuntu 22.04 | luanti, minetest | 0:5.10.0+dfsg-5+deb13u1build0.26.04.1 und 1 weitere |
Alle 24 Einträge aus 17 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 13 | luanti | 5.10.0+dfsg-5+deb13u1 |
| debian 14 | luanti | 5.15.2+dfsg-1 |
| echo | luanti | 5.10.0+dfsg-5+deb13u1 |
| rapidfort alpine 3.20 | minetest | kein Fix angegeben |
| rapidfort alpine 3.21 | minetest | kein Fix angegeben |
| rapidfort alpine 3.22 | minetest | kein Fix angegeben |
| rapidfort alpine 3.23 | minetest | kein Fix angegeben |
| rapidfort alpine 3.24 | minetest | kein Fix angegeben |
| rapidfort fedora 43 | minetest | 5.15.2-1.fc43 |
| rapidfort fedora 43 | minetest-data-common | 5.15.2-1.fc43 |
| rapidfort fedora 43 | minetest-server | 5.15.2-1.fc43 |
| rapidfort Oracle Linux 9 | minetest | kein Fix angegeben |
| rapidfort Oracle Linux 9 | minetest-data-common | kein Fix angegeben |
| rapidfort Oracle Linux 9 | minetest-server | kein Fix angegeben |
| rapidfort ubuntu 20.04 | luanti | 0:5.10.0+dfsg-5+deb13u1build0.26.04.1 |
| rapidfort ubuntu 20.04 | minetest | 0:5.10.0+dfsg-5 |
| rapidfort ubuntu 22.04 | luanti | 0:5.10.0+dfsg-5+deb13u1build0.26.04.1 |
| rapidfort ubuntu 22.04 | minetest | 0:5.10.0+dfsg-5 |
| rapidfort ubuntu 24.04 | luanti | 0:5.10.0+dfsg-5+deb13u1build0.26.04.1 |
| rapidfort ubuntu 24.04 | minetest | 0:5.10.0+dfsg-5 |
| ubuntu 20.04-ESM | minetest | 5.1.1+repack-1ubuntu0.1~esm1 |
| ubuntu 22.04 | minetest | kein Fix angegeben |
| ubuntu 24.04 | minetest | kein Fix angegeben |
| ubuntu 26.04 | luanti | 5.10.0+dfsg-5+deb13u1build0.26.04.1 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2026-41196
- https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557dc896
- https://github.com/luanti-org/luanti/security/advisories/GHSA-g596-mf82-w8c3
- https://nvd.nist.gov/vuln/detail/CVE-2026-41196
- https://ubuntu.com/security/notices/USN-8732-1
- https://www.cve.org/CVERecord?id=CVE-2026-41196