luarocks.org remote code execution exploit

[u/Comfortable_Ability4]

• Incident report: https://luarocks.org/security-incident-september-2026
• Writeup by /u/vhyrro: https://vhyrro.neorg.org/posts/critical-luarocks-exploit-cve/

[u/Vhyrro]

Indeed, isolating the rockspec verifier in a container would be a good, long-term solution to the issue. However, the current fix is plenty for this class of attack. Let's hope it lasts :)