CVE-2026-40959: Luanti Lua Sandbox Escape via Malicious Mod with LuaJIT
CVE-2026-40959 is a critical vulnerability in Luanti 5 before 5.15.2 when LuaJIT is used, allowing a Lua sandbox escape through a crafted mod. The record scores it 9.3 under CVSS 3.1 with a local attack vector and no privileges or user interaction required. No confirmed exploitation appears in the sources consulted, and the structured affected and fixed version data is still empty.
Overview The CVE record describes a Lua sandbox escape in Luanti 5 before 5.15.2 when LuaJIT is used. The weakness is associated with CWE-829, inclusion of functionality from an untrusted control sphere, and the attack path is a crafted mod. Luanti's maintainers published a GitHub Security Advisory and two commits that the record links to, as shown in the GHSA advisory. ## Impact The record assigns a CVSS 3.1 base score of 9.3 with vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which indicates high confidentiality, integrity and availability impact and a scope change. A sandbox escape means code in a mod could reach functionality the sandbox was meant to restrict. The exact practical consequences in deployed servers or clients are not described in the available data. ## Affected products and versions - Luanti 5 before 5.15.2, when LuaJIT is used, according to the description. - The structured affected product list in the record is empty, so the affected range should be confirmed against the vendor advisory. ## Exploitation status No confirmed exploitation appears in the sources consulted. The CVE is not listed in the CISA KEV catalog according to the record. The EPSS probability is low at 0.00194 with a percentile of 0.08385. ## Remediation and mitigation - Review the Luanti version in use and plan an upgrade to 5.15.2 or later, as the vulnerable range is stated as before 5.15.2. - Where LuaJIT is in use, prioritize servers and clients that load third-party or untrusted mods. - Restrict mod installation to trusted sources and review mod code before deployment until patched builds are in place. ## Detection guidance - Inventory Luanti installations and record whether LuaJIT is enabled. - Audit installed mods and recent mod changes for unexpected or unverified code. - Monitor game server logs for Lua errors or unusual behavior from mods, treating these as signals for review rather than confirmed compromise. ## Limitations of the available information The record has no structured affected versions, no fixed version field, and a null CWE name. The vendor-published fix details are only indirectly visible through the referenced commits and advisory. Exploit details, proof-of-concept availability and real-world impact are not present in the record.
Frequently asked questions
What is CVE-2026-40959?
It is a critical vulnerability in Luanti 5 before 5.15.2 when LuaJIT is used, allowing a Lua sandbox escape through a crafted mod.
Is CVE-2026-40959 known to be actively exploited?
The CVE is not listed in CISA KEV according to the record, and no confirmed exploitation appears in the sources consulted.
What should administrators do?
Review whether LuaJIT is enabled, plan an upgrade to 5.15.2 or later, and restrict mods to trusted, reviewed sources until patched builds are installed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.