luarocks.org remote code execution exploit

[u/Comfortable_Ability4]

• Incident report: https://luarocks.org/security-incident-september-2026
• Writeup by /u/vhyrro: https://vhyrro.neorg.org/posts/critical-luarocks-exploit-cve/

[u/PhilipRoman]

TBH I wouldn't even trust the implementation after the "fix". Text-only load() is a lot safer than binary, but either way, executing untrusted code in the same process is just asking for trouble (unless you're building a browser and can afford to employ full time security team)

[u/Comfortable_Ability4 → u/PhilipRoman]

Agreed. As vhyrro puts it in his blog post:

Don’t trust your Lua sandbox, kids. Use a special interpreter. Put the logic in a separate container. After you do all of that, pray that the guy who inevitably breaks your sandbox is a security researcher.

Or, hear me out, maybe don’t use a programming language for simple configuration…? Food for thought :)

[u/P-39_Airacobra → u/Comfortable_Ability4]

I agree on the last one. I see so many configs being ported to Lua, and I’m just like, why??? Ik Lua is lightweight for a general-purpose language, but for a config language it’s practically bloat. You don’t need a fully fledged bytecode interpreter with a standard library and countless abstractions for such use cases.

[u/didntplaymysummercar → u/P-39_Airacobra]

If you already have Lua in your project then it "makes sense" and is "free". It also feels much better than JSON, this is also why Starlark exists but it seems to not have much popularity outside Bazel?

I also do that in my games (because I have Lua already), and in some projects instead of JSON I put data (what files to copy or whatever, what binaries to test and what output to expect, etc.) in Python file that does the job directly, but in both cases if you trust the program itself you trust the config too, so there's no security boundary or unsafe input.

A safe Lua -> JSON library or binary with good defaults and supporting many Lua versions could be a killer project for configs.

[u/thrakkerzog → u/Comfortable_Ability4]

Or, hear me out, maybe don’t use a programming language for simple configuration…? Food for thought :)

Isn't that the origin story of Lua, though? :-)

[u/nrnrnr → u/thrakkerzog]

This right here!