CVE-2026-40959 — AI Deep Analysis Summary

🚨 **Essence**: Luanti < 5.15.2 suffers from a **Lua Sandbox Escape** via LuaJIT.…

🛡️ **Root Cause**: **CWE-829** (Inclusion of Functionality from Untrusted Control Sphere).…

📦 **Affected**: **Luanti** (the open-source voxel game engine). 📉 **Versions**: All versions **prior to 5.15.2**. If you are running an older build, you are vulnerable. 🕰️

💀 **Attacker Actions**: Gain **Host-Level Access**. 📂 **Data**: Exfiltrate sensitive files. 🔧 **Privileges**: Execute arbitrary commands on the host machine.…

🔓 **Threshold**: **Low**. 📝 **Auth**: **None required** (PR:N). 🖱️ **UI**: **None required** (UI:N). 🎯 **Access**: Local (AV:L). If a user runs a malicious mod, exploitation is straightforward. 🚀

🔍 **Public Exploit**: **No PoC available** in the provided data. 📜 **References**: Official GitHub commits and GHSA advisory exist, but no public exploit code is listed. 🕵️‍♂️

🔎 **Self-Check**: Verify your **Luanti version number**. 📋 **Action**: If version < 5.15.2, you are at risk. 🔍 **Scan**: Look for custom mods that interact deeply with LuaJIT internals. 🛑

✅ **Fixed**: **Yes**. 🩹 **Patch**: Upgrade to **Luanti 5.15.2** or later. 🔗 **Links**: See GitHub commits `53cef18` and `8a929df` for the official fix details. 📥

🚧 **No Patch Workaround**: **Disable Modding**. 🚫 Do not load untrusted mods. 🛡️ Isolate the game environment if possible. Since it requires local execution, restrict who can run the game client. 🏠

🔥 **Urgency**: **HIGH**. 🚨 **Priority**: Patch immediately. With **CVSS 9.0+** potential (S:C, C:H, I:H, A:H), the impact is catastrophic. Even without public exploits, the risk of local privilege escalation is severe. ⏳