Vulnerability in Minetest
CVE-2022-35978
Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.
EPSS: 0.022 (80.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L.
Affected products
- Minetest — versions <= 5.5.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-35978?
- CVE-2022-35978 is a high-severity vulnerability in Minetest, classified under Protection Mechanism Failure. CVSS score: 7.7/10. Published 2022-08-15.
- How severe is CVE-2022-35978?
- High severity. CVSS v3 base score is 7.7 out of 10.
- Is CVE-2022-35978 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.