by Kastro
Paper/Archive/CVE-2022-35978

CVE-2022-35978

minetest minetest — Lua sandbox escape from mod in Minetest

EPSS 3%CVSS 10.0
critical.is priorityof 100
48
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 87.8.878 × 2017.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.

Affected

ProductAffectedFixed inSource
minetest<= 5.5.1–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GitHub_M (CNA)7.7CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/minetest/minetest/security/advisories/GHSA-663q-pcjw-27ccrefgithub.com/minetest/minetest/commit/da71e86633d0b27cd02d7aac9fdac625d141ca13refdev.minetest.net/Changelog#5.5.0_.E2.86.92_5.6.0