Arbitrary Code Execution Vulnerability in Luanti Game-Creation Platform
CVE-2026-41196

9CRITICAL

Key Information:

Vendor

Luanti-org

Status
Luanti
Vendor
CVE Published:
23 April 2026

What is CVE-2026-41196?

Luanti, an open-source voxel game-creation platform, contains a vulnerability that allows malicious mods to escape its sandboxed Lua environment. This exploitation can lead to arbitrary code execution and full filesystem access on the user's device. The flaw affects both server-side and client-side mod environments, specifically when using LuaJIT. A patch is available in version 5.15.2, but users can also mitigate the threat on earlier versions by modifying the builtin/init.lua file. However, this workaround may disrupt other mods that depend on the getfenv function.

Affected Version(s)

luanti >= 5.0.0, < 5.15.2

References

https://github.com/luanti-org/luanti/security/advisories/...
x_refsource_CONFIRM
https://github.com/luanti-org/luanti/commit/8a929dfb97aa0...
x_refsource_MISC

CVSS V4

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.