CVE-2026-41196 Luanti has a mod security sandbox escape
A malicious mod can escape the Lua sandbox to execute arbitrary code and access the filesystem when LuaJIT is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41196?
CVE-2026-41196 is a critical code injection vulnerability in luanti-org luanti, published on 23 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments. This vulnerability is only exploitable when using LuaJIT. Version 5.15.2 contains a patch. On release versions, one can also patch this issue without recompiling by editing `builtin/init.lua` and adding the line `getfenv = nil` at the end. Note that this will break mods relying on this function (which is not inherently unsafe).
Weakness: CWE-94
Which versions are affected by CVE-2026-41196?
It affects 1 product.
Products include Minetest Minetest.
How do I fix CVE-2026-41196?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-41196 being exploited?
There is no known exploitation of CVE-2026-41196 in the wild and no public exploit code.
Other vulnerabilities in luanti-org luanti
Sources
Also known as DEBIAN-CVE-2026-41196, UBUNTU-CVE-2026-41196, USN-8732-1.