CVE-2026-40959
critical
CVSS v3
9.3
CVSS v4 NEW
—
VIR risk
9.3
Description
Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.
Predictions
Exploit likelihood
85%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | forky | fixed | 5.15.2+dfsg-1 |
| debian | sid | fixed | 5.15.2+dfsg-1 |
| debian | trixie | fixed | 5.10.0+dfsg-5+deb13u1 |
References
- https://github.com/luanti-org/luanti/commit/53cef183e2a85a4daff84ac1a9a7946f940da8f8
- https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557dc896
- https://github.com/luanti-org/luanti/security/advisories/GHSA-g596-mf82-w8c3
- https://www.suse.com/security/cve/CVE-2026-40959.html
- https://security-tracker.debian.org/tracker/CVE-2026-40959
CWEs
CWE-829
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.