Luanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.

The remote Ubuntu 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8366-1 advisory.

    It was discovered that Luanti, when using LuaJIT, did not properly enforce Lua sandbox restrictions. An     attacker could possibly use this issue to execute arbitrary code. (CVE-2026-40959)

    It was discovered that Luanti did not properly restrict access to insecure environments. An attacker could     possibly use this issue to obtain unintended access to the insecure environment or HTTP API.
    (CVE-2026-40960)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-036e523144 advisory.

    5.15.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b42cf3db3b advisory.

    5.15.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-52b9116b3d advisory.

    5.15.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6217 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6217-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     April 17, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : luanti     CVE ID         : CVE-2026-40959 CVE-2026-40960

    Two security issues were discovered in Luanti, a multiplayer     infinite-world block sandbox game, which could result in incomplete     restrictions for installed mods or sandbox escape.

    For the stable distribution (trixie), these problems have been fixed in     version 5.10.0+dfsg-5+deb13u1.

    We recommend that you upgrade your luanti packages.

    For the detailed security status of luanti please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/luanti

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
318677	Ubuntu 25.10 / 26.04 LTS : Luanti vulnerabilities (USN-8366-1)	Nessus	Ubuntu Local Security Checks	critical
310421	Fedora 42 : minetest (2026-036e523144)	Nessus	Fedora Local Security Checks	critical
310209	Fedora 44 : minetest (2026-b42cf3db3b)	Nessus	Fedora Local Security Checks	critical
310075	Fedora 43 : minetest (2026-52b9116b3d)	Nessus	Fedora Local Security Checks	critical
307614	Debian dsa-6217 : luanti - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2026-40959

critical

Tenable Plugins

critical

critical

critical

critical

critical