CVE-2026-41196
published 2026-04-23CVE-2026-41196: Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially…
PriorityP271critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
0.37%
29.3th percentile
Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments. This vulnerability is only exploitable when using LuaJIT. Version 5.15.2 contains a patch. On release versions, one can also patch this issue without recompiling by editing `builtin/init.lua` and adding the line `getfenv = nil` at the end. Note that this will break mods relying on this function (which is not inherently unsafe).
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| luanti-org | luanti | — | — |
| minetest | minetest | >= 5.0.0 < 5.15.2 | 5.15.2 |
Detection & IOCsextracted from sources · hover to see the quote
- →The sandbox escape vector is the `getfenv` Lua function. A malicious mod abusing `getfenv` in a LuaJIT environment should be treated as a high-confidence indicator of exploitation attempt. Monitor mod code for calls to `getfenv`. ↗
- →All four Luanti mod execution environments are in scope: server-side mod, async, mapgen, and client-side (CSM). Detection/monitoring should cover all four contexts, not just the server-side environment. ↗
- ·Vulnerable version range is 5.0.0 up to (not including) 5.15.2. Patch is available in version 5.15.2. Confirm installed version before applying mitigations. ↗
- ·A no-recompile workaround exists: edit `builtin/init.lua` and append `getfenv = nil`. Be aware this will break any mods that legitimately rely on `getfenv`. ↗
- ·Exploitation is strictly conditional on LuaJIT being the active Lua runtime. Installations using standard PUC Lua are NOT affected. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.0CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-41196 luanti: minetest: luajit: Luanti (Minetest): Arbitrary code execution and full filesystem access via malicious mod sandbox escape
bugzilla·2026-04-23·CVSS 9.0
CVE-2026-41196 [CRITICAL] CVE-2026-41196 luanti: minetest: luajit: Luanti (Minetest): Arbitrary code execution and full filesystem access via malicious mod sandbox escape
CVE-2026-41196 luanti: minetest: luajit: Luanti (Minetest): Arbitrary code execution and full filesystem access via malicious mod sandbox escape
Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments. This vulnerability is only exploitable when using LuaJIT. Version 5.15.2 contains a patch. On release versions, one can also patch this issue without recompiling by editing `builtin/init.lua` and adding the line `getfenv = nil` at the end. Note that this will break mods relyi
Bugzilla
CVE-2026-41196 minetest: Luanti (Minetest): Arbitrary code execution and full filesystem access via malicious mod sandbox escape [fedora-all]
bugzilla·2026-04-23·CVSS 9.0
CVE-2026-41196 [CRITICAL] CVE-2026-41196 minetest: Luanti (Minetest): Arbitrary code execution and full filesystem access via malicious mod sandbox escape [fedora-all]
CVE-2026-41196 minetest: Luanti (Minetest): Arbitrary code execution and full filesystem access via malicious mod sandbox escape [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
Proposed as a Freeze Exception for 44-final by Fedora user augenauf using the blocker tracking app because:
Let's make sure we don't ship this CVE in the iso. Will minetest 5.15.2-1.fc44 (currently in testing) be included in the release iso?
2026-04-23
Published