安全研究员 Vhyrro 在主要的 Lua 包仓库 luarocks.org 中发现了一个严重的远程代码执行 (RCE) 漏洞。
Critical Remote Code Execution Vulnerability Discovered in Luarocks.org Security researcher Vhyrro discovered a critical remote code execution (RCE) vulnerability in luarocks.org, a major Lua package repository.
该漏洞允许任何拥有普通账户的用户通过上传恶意构造的 Lua 字节码获取服务器的 root 权限。
The exploit allowed any user with a regular account to achieve root access on the server by uploading maliciously crafted Lua bytecode.
通过滥用 LuaJIT 中的 KNUM 指令读取越界内存，研究人员能够转向全局环境并执行任意系统命令。
By abusing the KNUM instruction in LuaJIT to read out-of-bounds memory, the researcher was able to pivot to the global environment and execute arbitrary system commands.
该漏洞可能通过感染广泛使用的 Lua 包实现大规模供应链攻击。该问题已于 2026 年 9 月 26 日修复。
The vulnerability could have enabled a massive supply chain attack by infecting widely used Lua packages. The issue was patched on September 26, 2026.