Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

UBUNTU-CVE-2026-40959 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceUBUNTU-CVE-2026-40959

UBUNTU-CVE-2026-40959

CRITICAL9.3

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

Published Apr 16, 2026

Modified 2 days ago

Fix available

Details

Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

Affected Packages

luanti

Ubuntu 25.10

Fixed in:

5.10.0+dfsg-5+deb13u1build0.25.10.1

luanti

Ubuntu 26.04 LTS

Fixed in:

5.10.0+dfsg-5+deb13u1build0.26.04.1

References

REPORT

https://github.com/luanti-org/luanti/commit/53cef183e2a85a4daff84ac1a9a7946f940da8f8

REPORT

https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557dc896

REPORT

https://github.com/luanti-org/luanti/security/advisories/GHSA-g596-mf82-w8c3

REPORT

https://ubuntu.com/security/CVE-2026-40959

ADVISORY

https://ubuntu.com/security/notices/USN-8366-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2026-40959

CVSS Analysis

CVSS v3.1

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Upstream

CVE-2026-40959

USN-8366-1

Ecosystems

Ubuntu 25.10 Ubuntu 26.04 LTS

Timeline

PublishedApr 16, 2026

ModifiedJun 2, 2026