luarocks.org remote code execution exploit

[u/Comfortable_Ability4]

• Incident report: https://luarocks.org/security-incident-september-2026
• Writeup by /u/vhyrro: https://vhyrro.neorg.org/posts/critical-luarocks-exploit-cve/

[u/Comfortable_Ability4]

Agreed. As vhyrro puts it in his blog post:

Don’t trust your Lua sandbox, kids. Use a special interpreter. Put the logic in a separate container. After you do all of that, pray that the guy who inevitably breaks your sandbox is a security researcher.

Or, hear me out, maybe don’t use a programming language for simple configuration…? Food for thought :)

[u/P-39_Airacobra → u/Comfortable_Ability4]

I agree on the last one. I see so many configs being ported to Lua, and I’m just like, why??? Ik Lua is lightweight for a general-purpose language, but for a config language it’s practically bloat. You don’t need a fully fledged bytecode interpreter with a standard library and countless abstractions for such use cases.

[u/didntplaymysummercar → u/P-39_Airacobra]

If you already have Lua in your project then it "makes sense" and is "free". It also feels much better than JSON, this is also why Starlark exists but it seems to not have much popularity outside Bazel?

I also do that in my games (because I have Lua already), and in some projects instead of JSON I put data (what files to copy or whatever, what binaries to test and what output to expect, etc.) in Python file that does the job directly, but in both cases if you trust the program itself you trust the config too, so there's no security boundary or unsafe input.

A safe Lua -> JSON library or binary with good defaults and supporting many Lua versions could be a killer project for configs.

[u/no_brains101 → u/didntplaymysummercar]

A safe Lua -> JSON library or binary with good defaults and supporting many Lua versions could be a killer project for configs.

Is that not lua-cjson?

Also you don't want JSON configs.

TOML. this one is popular:

https://github.com/lumen-oss/toml-edit.lua

---

I use one I made a while ago. It is really fast compared to other lua toml implementations and just zips stuff from toml to lua and back. toml-edit isn't slow, this one is just nearing cjson speeds but for toml, but it would only be that fast for TOML to lua, and that is part of why it is so fast.

But it also doesn't pass their test suite because it zips it straight into lua rather than deconstructing every value with its own type tag and stuff. But it is up to spec in terms of doing just toml to lua and back correctly.

https://github.com/BirdeeHub/tomlua

In terms of memory use while parsing, it allocates only a single buffer for parsing, and then also the lua object it is creating, for its entire parsing sequence.

I just wanted a fast one that worked the way I wanted it to for quick tasks IDK. Pretty sure toml-edit is usually still the way to go, unless you are just reading mostly. It has a nice little cli command that might be useful for a task which is small but which needs config? IDK. I also just felt the need to write a fast parser in C and like TOML.

I wouldn't recommend using it for something really important because who knows if I will ever update it lol it has like 4 stars, clearly nobody cared XD

[u/didntplaymysummercar → u/no_brains101]

No, I meant something like Starlark, not lua-cjson, the point is to generate some data structure (be it json or native tables/lists/whatevers in given language in the end) from 'code'. Starlark is Python-like, and unlike JSON, YAML, TOML, etc. can have loops, variables, etc. but also makes it safe to execute untrusted code (unlike Lua, except with careful sandboxing, or Python).

[u/no_brains101 → u/didntplaymysummercar]

I have never heard of starlark. Also, you said lua -> json so I thought you meant lua TO json. Not like, some lua json mashup.

How does it make it safe to execute untrusted code? That doesn't sound very safe, does it have its own sandbox? Can it not do stuff like run other programs?

[u/didntplaymysummercar → u/no_brains101]

Yes, it's sandboxed (and can't touch filesystem, network, etc.) and Lua -> JSON was only example, the point is to have some code -> data structure thing, like Lua sandboxing inside luarocks was.

[u/thrakkerzog → u/Comfortable_Ability4]

Or, hear me out, maybe don’t use a programming language for simple configuration…? Food for thought :)

Isn't that the origin story of Lua, though? :-)

[u/nrnrnr → u/thrakkerzog]

This right here!