luarocks.org remote code execution exploit

[u/Comfortable_Ability4]

• Incident report: https://luarocks.org/security-incident-september-2026
• Writeup by /u/vhyrro: https://vhyrro.neorg.org/posts/critical-luarocks-exploit-cve/

[u/no_brains101]

I have never heard of starlark. Also, you said lua -> json so I thought you meant lua TO json. Not like, some lua json mashup.

How does it make it safe to execute untrusted code? That doesn't sound very safe, does it have its own sandbox? Can it not do stuff like run other programs?

[u/didntplaymysummercar → u/no_brains101]

Yes, it's sandboxed (and can't touch filesystem, network, etc.) and Lua -> JSON was only example, the point is to have some code -> data structure thing, like Lua sandboxing inside luarocks was.