CVE-2026-41196
luanti: minetest: luajit: Luanti (Minetest): Arbitrary code execution and full filesystem access via malicious mod sandbox escape
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (high), Ubuntu (medium).
Description
Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments. This vulnerability is only exploitable when using LuaJIT. Version 5.15.2 contains a patch. On release versions, one can also patch this issue without recompiling by editing `builtin/init.lua` and adding the line `getfenv = nil` at the end. Note that this will break mods relying on this function (which is not inherently unsafe).
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 13 | luanti | 5.10.0+dfsg-5+deb13u1 |
| debian 14 | luanti | 5.15.2+dfsg-1 |
| echo | luanti | 5.10.0+dfsg-5+deb13u1 |
| rapidfort alpine 3.20 | minetest | no fix listed |
| rapidfort alpine 3.21 | minetest | no fix listed |
| rapidfort alpine 3.22 | minetest | no fix listed |
| rapidfort alpine 3.23 | minetest | no fix listed |
| rapidfort alpine 3.24 | minetest | no fix listed |
| rapidfort fedora 43 | minetest, minetest-data-common, minetest-server | 5.15.2-1.fc43 |
| rapidfort Oracle Linux 9 | minetest, minetest-data-common, minetest-server | no fix listed |
| rapidfort ubuntu 20.04 | luanti, minetest | 0:5.10.0+dfsg-5+deb13u1build0.26.04.1 and 1 more |
| rapidfort ubuntu 22.04 | luanti, minetest | 0:5.10.0+dfsg-5+deb13u1build0.26.04.1 and 1 more |
Show all 24 entries from 17 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 13 | luanti | 5.10.0+dfsg-5+deb13u1 |
| debian 14 | luanti | 5.15.2+dfsg-1 |
| echo | luanti | 5.10.0+dfsg-5+deb13u1 |
| rapidfort alpine 3.20 | minetest | no fix listed |
| rapidfort alpine 3.21 | minetest | no fix listed |
| rapidfort alpine 3.22 | minetest | no fix listed |
| rapidfort alpine 3.23 | minetest | no fix listed |
| rapidfort alpine 3.24 | minetest | no fix listed |
| rapidfort fedora 43 | minetest | 5.15.2-1.fc43 |
| rapidfort fedora 43 | minetest-data-common | 5.15.2-1.fc43 |
| rapidfort fedora 43 | minetest-server | 5.15.2-1.fc43 |
| rapidfort Oracle Linux 9 | minetest | no fix listed |
| rapidfort Oracle Linux 9 | minetest-data-common | no fix listed |
| rapidfort Oracle Linux 9 | minetest-server | no fix listed |
| rapidfort ubuntu 20.04 | luanti | 0:5.10.0+dfsg-5+deb13u1build0.26.04.1 |
| rapidfort ubuntu 20.04 | minetest | 0:5.10.0+dfsg-5 |
| rapidfort ubuntu 22.04 | luanti | 0:5.10.0+dfsg-5+deb13u1build0.26.04.1 |
| rapidfort ubuntu 22.04 | minetest | 0:5.10.0+dfsg-5 |
| rapidfort ubuntu 24.04 | luanti | 0:5.10.0+dfsg-5+deb13u1build0.26.04.1 |
| rapidfort ubuntu 24.04 | minetest | 0:5.10.0+dfsg-5 |
| ubuntu 20.04-ESM | minetest | 5.1.1+repack-1ubuntu0.1~esm1 |
| ubuntu 22.04 | minetest | no fix listed |
| ubuntu 24.04 | minetest | no fix listed |
| ubuntu 26.04 | luanti | 5.10.0+dfsg-5+deb13u1build0.26.04.1 |
References
- https://access.redhat.com/security/cve/CVE-2026-41196
- https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557dc896
- https://github.com/luanti-org/luanti/security/advisories/GHSA-g596-mf82-w8c3
- https://nvd.nist.gov/vuln/detail/CVE-2026-41196
- https://ubuntu.com/security/notices/USN-8732-1
- https://www.cve.org/CVERecord?id=CVE-2026-41196