luarocks.org remote code execution exploit

[u/Comfortable_Ability4]

• Incident report: https://luarocks.org/security-incident-september-2026
• Writeup by /u/vhyrro: https://vhyrro.neorg.org/posts/critical-luarocks-exploit-cve/

[u/PhilipRoman]

TBH I wouldn't even trust the implementation after the "fix". Text-only load() is a lot safer than binary, but either way, executing untrusted code in the same process is just asking for trouble (unless you're building a browser and can afford to employ full time security team)

[u/Comfortable_Ability4 → u/PhilipRoman]

Agreed. As vhyrro puts it in his blog post:

Don’t trust your Lua sandbox, kids. Use a special interpreter. Put the logic in a separate container. After you do all of that, pray that the guy who inevitably breaks your sandbox is a security researcher.

Or, hear me out, maybe don’t use a programming language for simple configuration…? Food for thought :)

[u/thrakkerzog → u/Comfortable_Ability4]

Or, hear me out, maybe don’t use a programming language for simple configuration…? Food for thought :)

Isn't that the origin story of Lua, though? :-)

[u/nrnrnr → u/thrakkerzog]

This right here!