Luanti (formerly Minetest) is vulnerable to a code injection flaw in versions 5.0.0 through 5.15.1 due to improper control over code generation in its Lua sandbox environment. This flaw allows malicious mods to escape sandbox restrictions and execute arbitrary code on the host system, gaining full filesystem access. The vulnerability affects multiple mod environments including server-side and client-side mods when LuaJIT is enabled. The issue is fixed in version 5.15.2. Alternatively, users can mitigate the vulnerability without recompilation by adding 'getfenv = nil' to the end of builtin/init.lua, which disables a function that enables the exploit but may break some mods.

Exploitation allows arbitrary code execution with full filesystem access on the user's device, compromising system integrity and confidentiality. This can lead to complete system compromise through malicious mods. The vulnerability is critical with a CVSS 4.0 score of 9.0, indicating high attack vector and impact. No known exploits in the wild have been reported yet.

A patch is available in Luanti version 5.15.2 that fixes this vulnerability. Users should upgrade to this version to fully remediate the issue. If upgrading is not immediately possible, a temporary mitigation can be applied by editing the builtin/init.lua file to add the line 'getfenv = nil' at the end, which disables the function enabling the exploit. Note that this workaround may break mods that rely on getfenv. Monitor vendor advisories for any further updates or official guidance.