CVE-2026-40959: Luanti 5 RCE Vulnerability

CVE-2026-40959 Overview

CVE-2026-40959 is a critical sandbox escape vulnerability in Luanti (formerly known as Minetest) versions 5 before 5.15.2 when LuaJIT is used as the Lua interpreter. The vulnerability allows attackers to bypass the Lua sandbox restrictions through a specially crafted mod, potentially leading to arbitrary code execution on the host system.

Critical Impact

A malicious mod can escape the Lua sandbox environment, allowing attackers to execute arbitrary code with the privileges of the Luanti process, potentially compromising the entire host system.

Affected Products

• Luanti 5 versions prior to 5.15.2 (when using LuaJIT)

Discovery Timeline

• 2026-04-16 - CVE-2026-40959 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-40959

Vulnerability Analysis

This vulnerability is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), which describes scenarios where software includes functionality from a source that is outside of the intended control sphere. In the context of Luanti, the game engine relies on a Lua sandbox to restrict what mods can do, preventing them from accessing dangerous system functions or escaping the game environment.

When LuaJIT is used as the Lua interpreter, certain implementation differences between LuaJIT and standard Lua create opportunities for sandbox escape. LuaJIT's optimizations and JIT compilation mechanisms can be exploited to bypass the security restrictions that the Luanti sandbox is designed to enforce. An attacker who can distribute or convince a user to install a malicious mod can leverage this vulnerability to break out of the sandbox entirely.

The local attack vector indicates that exploitation requires the victim to download and install the malicious mod locally. However, since mods are commonly shared through community platforms and the game encourages mod usage, the practical attack surface is significant. Successful exploitation grants the attacker code execution capabilities with the same privileges as the Luanti process, which could lead to data theft, malware installation, or further system compromise.

Root Cause

The root cause of this vulnerability lies in the interaction between LuaJIT's execution model and Luanti's sandbox implementation. LuaJIT provides performance optimizations that differ from the reference Lua interpreter, and these differences can create edge cases where sandbox restrictions are not properly enforced. The sandbox relies on restricting access to dangerous Lua functions and modules, but LuaJIT's internal mechanisms may expose alternative pathways to achieve similar functionality.

Attack Vector

The attack requires a threat actor to create a malicious Luanti mod that contains specially crafted Lua code designed to exploit the sandbox escape. The attack flow typically involves:

1. Attacker crafts a malicious mod containing Lua code that exploits LuaJIT-specific behaviors
2. The mod is distributed through community channels, mod repositories, or direct sharing
3. Victim downloads and installs the mod in their Luanti installation
4. When Luanti loads and executes the mod's Lua code with LuaJIT, the crafted payload escapes the sandbox
5. Arbitrary code execution is achieved on the victim's system with Luanti process privileges

The vulnerability does not require any user interaction beyond installing the mod, as the malicious code executes automatically when the game loads the mod. For detailed technical implementation, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-40959

Indicators of Compromise

• Unexpected system calls or process spawning originating from the Luanti process
• Network connections initiated by Luanti to suspicious external hosts
• File system modifications outside of expected Luanti directories
• Presence of unknown or recently modified mods in the Luanti mods directory

Detection Strategies

• Monitor process behavior for Luanti instances attempting to execute system commands or spawn child processes
• Implement application allowlisting to detect unauthorized code execution from game directories
• Review installed mods against known-good checksums from trusted sources
• Use endpoint detection tools to identify sandbox escape patterns in scripting engines

Monitoring Recommendations

• Enable detailed logging for Luanti installations, particularly in server environments
• Monitor for unusual file access patterns from the Luanti process
• Implement network monitoring to detect unexpected outbound connections from game processes
• Regularly audit installed mods and their sources in multi-user or server deployments

How to Mitigate CVE-2026-40959

Immediate Actions Required

• Upgrade Luanti to version 5.15.2 or later immediately
• Audit all installed mods and remove any from untrusted or unknown sources
• Consider using standard Lua interpreter instead of LuaJIT if upgrade is not immediately possible
• Restrict Luanti installations to isolated environments until patched

Patch Information

The Luanti development team has released security patches to address this vulnerability. The fixes are available in the following commits:

• GitHub Commit 53cef18 - Initial security fix
• GitHub Commit 8a929df - Additional security hardening

Users should update to Luanti 5.15.2 or later, which includes these patches. For complete details on the vulnerability and remediation, see the GitHub Security Advisory.

Workarounds

• Switch from LuaJIT to standard Lua interpreter if supported by your Luanti build
• Only install mods from verified and trusted sources with established reputations
• Run Luanti in a sandboxed environment such as a container or virtual machine
• Disable mod loading entirely if mods are not required for your use case

# Configuration example
# Example: Run Luanti in a restricted environment using Firejail
firejail --private --net=none luanti

# Or use a container to isolate the Luanti process
podman run --rm -it --security-opt=no-new-privileges luanti:5.15.2