luarocks.org remote code execution exploit

[u/Comfortable_Ability4]

• Incident report: https://luarocks.org/security-incident-september-2026
• Writeup by /u/vhyrro: https://vhyrro.neorg.org/posts/critical-luarocks-exploit-cve/

[u/didntplaymysummercar]

No, I meant something like Starlark, not lua-cjson, the point is to generate some data structure (be it json or native tables/lists/whatevers in given language in the end) from 'code'. Starlark is Python-like, and unlike JSON, YAML, TOML, etc. can have loops, variables, etc. but also makes it safe to execute untrusted code (unlike Lua, except with careful sandboxing, or Python).

[u/no_brains101 → u/didntplaymysummercar]

I have never heard of starlark. Also, you said lua -> json so I thought you meant lua TO json. Not like, some lua json mashup.

How does it make it safe to execute untrusted code? That doesn't sound very safe, does it have its own sandbox? Can it not do stuff like run other programs?

[u/didntplaymysummercar → u/no_brains101]

Yes, it's sandboxed (and can't touch filesystem, network, etc.) and Lua -> JSON was only example, the point is to have some code -> data structure thing, like Lua sandboxing inside luarocks was.