Luanti versions from 5.0.0 to before 5.15.2 contain a vulnerability (CWE-94) that allows malicious Lua mods to escape sandbox restrictions and execute arbitrary code with full filesystem access. This applies to both server-side and client-side mod environments when LuaJIT is enabled. The issue is resolved in version 5.15.2. Alternatively, users can mitigate the vulnerability without recompilation by adding 'getfenv = nil' to builtin/init.lua, which disables a function that enables the exploit but may impact legitimate mods.

Exploitation allows a malicious mod to break out of the Lua sandbox and execute arbitrary code on the host system, resulting in full filesystem access. This can lead to complete compromise of the affected device running luanti versions prior to 5.15.2 when LuaJIT is used. There are no known exploits in the wild as of the published date.

Upgrade to luanti version 5.15.2 or later, which contains an official patch for this vulnerability. If upgrading is not immediately possible, apply the manual mitigation by editing builtin/init.lua to add the line 'getfenv = nil' at the end, understanding this may break some mods that rely on this function. No other vendor advisories or patches are provided, so check the official luanti project for updates.