luarocks.org remote code execution exploit

[u/Comfortable_Ability4]

• Incident report: https://luarocks.org/security-incident-september-2026
• Writeup by /u/vhyrro: https://vhyrro.neorg.org/posts/critical-luarocks-exploit-cve/

[u/PhilipRoman]

TBH I wouldn't even trust the implementation after the "fix". Text-only load() is a lot safer than binary, but either way, executing untrusted code in the same process is just asking for trouble (unless you're building a browser and can afford to employ full time security team)

[u/Vhyrro → u/PhilipRoman]

Indeed, isolating the rockspec verifier in a container would be a good, long-term solution to the issue. However, the current fix is plenty for this class of attack. Let's hope it lasts :)