CVE-2026-41196

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41196
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41196.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41196
Aliases
Downstream
Published
2026-04-23T00:28:56.716Z
Modified
2026-07-22T00:13:06.394794Z
Severity
  • 9.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Luanti has a mod security sandbox escape
Details

Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to version 5.15.2, a malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device. This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments. This vulnerability is only exploitable when using LuaJIT. Version 5.15.2 contains a patch. On release versions, one can also patch this issue without recompiling by editing builtin/init.lua and adding the line getfenv = nil at the end. Note that this will break mods relying on this function (which is not inherently unsafe).

Database specific 
{
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41196.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/luanti-org/luanti

Affected ranges

Type
GIT
Repo
https://github.com/luanti-org/luanti
Events
Introduced
f9d1810b1e763a6c0a47ff30bd83d7903d3d614f
Fixed
044ab8a35be38593aefd8fdde9601cc44754f3cc
Fixed
8a929dfb97aa08337f49ba1bb96a56d6557dc896
Database specific 
{
    "cpe": "cpe:2.3:a:minetest:minetest:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.15.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

5.*
5.0.0
5.1.0
5.10.0
5.10.0-rc1
5.11.0
5.11.0-rc1
5.12.0
5.13.0
5.14.0
5.14.0-rc1
5.15.0
5.15.0-rc1
5.15.1
5.2.0
5.3.0
5.4.0
5.5.0
5.6.0
5.7.0
5.8.0
5.9.0

Database specific

vanir_signatures 
[
    {
        "target": {
            "function": "ScriptApiSecurity::initializeSecurity",
            "file": "src/script/cpp_api/s_security.cpp"
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "120606739084800193016727374647229860780",
            "length": 2996.0
        },
        "id": "CVE-2026-41196-04ea50d8",
        "source": "https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557dc896"
    },
    {
        "target": {
            "function": "copy_safe",
            "file": "src/script/cpp_api/s_security.cpp"
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "314273350244027079147520173059514018746",
            "length": 432.0
        },
        "id": "CVE-2026-41196-0e579949",
        "source": "https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557dc896"
    },
    {
        "target": {
            "file": "src/script/cpp_api/s_security.cpp"
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "93936849807352931967759263488727952644",
                "242801593564771671713592393815689084576",
                "39060867095625450856148189063008599088",
                "48669683089757005283550464565890267898",
                "49185602305760649156202113900379723214",
                "251766328101995254249272064101922266542",
                "74719095492757865114628962363008826747",
                "291946694124842034141224675234025457611",
                "263995643121613734379199883932908430165",
                "21161391513351090860662410640736707109",
                "238794681838185918122392715746071150039",
                "192464762250222846004689213200699417517",
                "89164338073075511921030458304319056446",
                "34643494272621024451228682779647092170",
                "22057741802274873114348580020876722850",
                "79384837367324251299331017716641623696",
                "312694622499899597508856119879564457364",
                "199851978193059524602204051072448947022",
                "272422087372569589855480144244148073772",
                "50897038938994749840275283257518642308",
                "52875903685135535429725290587529907432",
                "263003349623355282972175076888053654082",
                "267004654752900518978356979337924737394",
                "330878371792048420629860192076897042303",
                "279492879305959988064804176081796167938",
                "190212060441169296512942232137391703392",
                "158560817364207063238019489531225604653",
                "8014930620640761437289874153745718192",
                "293872918487948371098687880977571585028",
                "253810880041646027555068123072265681844",
                "30617312375019875421858828469575629316",
                "284064100128166429404868305313421291047",
                "185364243569268398131838667567473512959",
                "326944482375696216650545454470051357316",
                "88378226449573789318741850532174834081",
                "252434616142591236776110756513099895863",
                "235943237687456610681855570423720778118",
                "255606096423296136350554169914231092291",
                "55070953307877546151448181265232107939",
                "241479428024227183696410313328851838428",
                "46898980790008406924463000907456201763",
                "284160733746002511150805662574250393567",
                "99467301108736414945918328354383543900",
                "309670773932873056882857235305238543160",
                "331604741519710898045985959640830212261",
                "194268803760318787881489862446205960624",
                "29484471563453786225447319888612045745",
                "183285439915745030019688626282262633698",
                "5990578828526638302512416488224243738",
                "41618734894770706913952209076260543570",
                "145004566067589567287341900300287576160",
                "111165401373647039263979889716590998658",
                "209252141882748608855099114095371922416",
                "220071815960831338652036681191006456278",
                "12987194617750071869236121184249489949",
                "196590952060210298645166207029191130624",
                "72146429287205672513797661375355361652",
                "183993020514943844681422830138755022725",
                "206980499942942937962595609494311516256",
                "293317169058837457647691067535729112916",
                "31284498755698096672563535588838162488",
                "93765414157616192118153504118056741648",
                "22290217924645231904976635672181266523",
                "241346161086818580377831242069088649661",
                "248089341411800520601963325360128184994",
                "25058321579546135996488355547790362381",
                "329939314152619891852969480595584854884",
                "35203083896678587642986717135868535877",
                "80703191207919017972604587110777379173",
                "328612748867596322658596937894108462617",
                "168418841993087992510035137459664556597",
                "19080661826731535283019013351926939464",
                "172250267200473555899256006987243396116",
                "135058817854257088057320284068053186320",
                "36624488718660784114979481836450141448",
                "19080661826731535283019013351926939464",
                "172250267200473555899256006987243396116",
                "135058817854257088057320284068053186320",
                "36624488718660784114979481836450141448"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41196-12820bf9",
        "source": "https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557dc896"
    },
    {
        "target": {
            "function": "ScriptApiSecurity::initializeSecurityClient",
            "file": "src/script/cpp_api/s_security.cpp"
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "245714188027739817917407442080037623122",
            "length": 1832.0
        },
        "id": "CVE-2026-41196-2b52d2e6",
        "source": "https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557dc896"
    },
    {
        "target": {
            "function": "ScriptApiSecurity::initializeSecuritySSCSM",
            "file": "src/script/cpp_api/s_security.cpp"
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "338156066133292403058993983318245168316",
            "length": 1853.0
        },
        "id": "CVE-2026-41196-6e7bdcad",
        "source": "https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557dc896"
    },
    {
        "target": {
            "function": "shallow_copy_table",
            "file": "src/script/cpp_api/s_security.cpp"
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "305329612052664987282424360327331557456",
            "length": 428.0
        },
        "id": "CVE-2026-41196-c1b8e946",
        "source": "https://github.com/luanti-org/luanti/commit/8a929dfb97aa08337f49ba1bb96a56d6557dc896"
    }
]
vanir_signatures_modified 
"2026-07-22T00:13:06Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41196.json"