Vulnerability in Minetest
CVE-2022-35978
Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L.
EPSS exploit prediction
EPSS: 0.029 (86.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 86.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.029 · newest: 0.029 · change: 0.000
Affected products
- Minetest — versions <= 5.5.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/minetest/minetest/security/advisories/GHSA-663q-pcjw-27cc (Third Party Advisory)
- github.com/minetest/minetest/commit/da71e86633d0b27cd02d7aac9fdac625d141ca13 (Patch, Third Party Advisory)
- dev.minetest.net/Changelog (Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-35978?
- CVE-2022-35978 is a high-severity vulnerability in Minetest, classified under Protection Mechanism Failure. CVSS score: 7.7/10. Published 2022-08-15.
- How severe is CVE-2022-35978?
- High severity. CVSS v3 base score is 7.7 out of 10.
- Is CVE-2022-35978 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.