LuaRocks.org disclosed a remote code execution flaw in the code that processes uploaded rockspecs, saying it was reported on September 25 through CISA, fixed on September 26, and had been exploited on the server several times between July 9 and August 20, 2026. Because the site loaded rockspecs with loadstring, which in LuaJIT and Lua 5.1 accepts precompiled bytecode as well as source, an uploaded file could escape the sandbox that was meant to keep it away from globals and execute arbitrary code on the server; the project said it is treating everything the server had access to as exposed. It moved the site to a newly built server, revoked and replaced every credential the old one held, removed three packages the attacker uploaded on August 7, and told users to create new API keys, log in again, change passwords, re-enroll two-factor authentication, and upgrade to LuaRocks 3.12 or newer so that rockspecs and manifests are no longer loaded as bytecode on LuaJIT and Lua 5.1. The project said it found no evidence that existing packages were modified.
LuaRocks.org discloses a server breach that ran code from crafted rockspecs
LuaRocks.org disclosed a remote code execution flaw in the code that processes uploaded rockspecs, saying it was reported on September 25 through CISA, fixed on September 26, and had been exploited on the server several times between July 9 and August 20, 2026. Because the site loaded rockspecs with loadstring, which in LuaJIT and Lua 5.1 accepts precompiled bytecode as well as source, an uploaded file could escape the sandbox that was meant to keep it away from globals and execute arbitrary code on the server; the project said it is treating everything the server had access to as exposed. It moved the site to a newly built server, revoked and replaced every credential the old one held, removed three packages the attacker uploaded on August 7, and told users to create new API keys, log in again, change passwords, re-enroll two-factor authentication, and upgrade to LuaRocks 3.12 or newer so that rockspecs and manifests are no longer loaded as bytecode on LuaJIT and Lua 5.1. The project said it found no evidence that existing packages were modified.
Source: Luarocks