CVE-2026-40959 - Vulnerability Analysis

Overview

Luanti 5 < 5.15.2 contains a sandbox escape caused by crafted mod exploiting LuaJIT, letting attackers escape Lua sandbox, exploit requires use of LuaJIT.

Severity & Score

Impact

Attackers can escape the Lua sandbox, potentially executing arbitrary code or commands.

Mitigation

Update to version 5.15.2 or later.

References

• https://github.com/luanti-org/luanti/security/advisories/GHSA-g596-mf82-w8c3
• https://github.com/luanti-org/luanti/commit/53cef183e2a85a4daff84ac1a9a7946f940da8f8
• https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557dc896

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 16, 2026

🔴 CVE-2026-40959 - Critical (9.3) Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40959/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner