anonhaven
Ad

CVE-2026-40959

CRITICAL CVSS 3.1: 9.3
Updated Apr 17, 2026
Luanti
Parameter Value
CVSS 9.3 (CRITICAL)
Affected Versions before 5.15.2
Type CWE-829 (Inclusion of Functionality from Untrusted Source)
Vendor Luanti
Public PoC No

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

Attack Parameters

Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-829 Inclusion of Functionality from Untrusted Source

References 3

https://github.com/luanti-org/luanti/commit/53cef183e2a85a4daff84ac1a9a7946f940…
cve@mitre.org
https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557…
cve@mitre.org
https://github.com/luanti-org/luanti/security/advisories/GHSA-g596-mf82-w8c3
cve@mitre.org
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-40960

Luanti

8.1