Lua
Monthly
Denial of service in the Lua language bindings of Apache Thrift allows unauthenticated remote attackers to exhaust CPU resources by supplying pathologically crafted input to a regular-expression or parsing code path in releases before 0.25.0, consistent with CWE-1333 (inefficient regular expression complexity). The CVSS 4.0 vector scores 8.2 with AT:P, indicating that a specific attack prerequisite must be met: the deployment must actually use the Lua bindings and attacker-controlled data must reach the vulnerable parsing path, so exploitation is not fully attacker-controlled. The vendor-released fix is Apache Thrift 0.25.0; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), with the effective risk concentrated in services that parse untrusted input through the Lua binding.
Command injection in the USB Device Management API (pop_usb_device) of the Ziroom ZHOME A0101 smart-home hub running firmware 1.0.1.0 lets a remote attacker who already holds administrator credentials execute arbitrary operating-system commands on the device by manipulating the 'path' argument. Publicly available exploit code exists (published with a write-up, and a PoC linked by VulDB), but there is no indication of confirmed active exploitation (not in CISA KEV). The practical exposure is gated by the need for a valid high-privilege admin session against the hub's LuCI web interface, which tempers the high CVSS 4.0 base score of 8.5.
Authenticated non-administrator users of ntopng prior to 6.7.260718 can list and download complete system-configuration backups through the REST v2 endpoints get/system/configurations/list_available_backups.lua and download_backup.lua, which lack the administrator authorization check that the vendor's fix adds. Because the backup payload includes the ntopng.user.* Redis key space, the downloaded archive routinely discloses local-user password hashes and, on deployments where those features are configured, API tokens, TOTP secrets and WebAuthn credential material - enabling account takeover via usable or crackable credentials. Exploitation requires only a valid low-privileged login (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N per independent assessment, PR:L means authenticated but not administrative), with no user interaction and no non-default configuration; no public exploit code or active-exploitation activity (CISA KEV) was identified at time of analysis. The vendor's own CVSS of 8.8 with I:H/A:H is judged slightly overstated, since the flaw is an information-disclosure primitive rather than direct integrity or availability loss.
Any authenticated but non-administrator user on ntopng deployments prior to 6.7.260717 can tamper with threat-intelligence blocklists through the REST endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua, which performed no administrator check before invoking lists_utils.editList. By manipulating the list_name, list_enabled, url, and list_update parameters, a low-privileged account can repoint blocklist downloads to attacker-controlled content, disable existing blocklists, or suppress scheduled updates, with the changes persisted in Redis and reloaded without a lower-level authorization guard. This yields high integrity and availability impact (CVSS 3.1 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) but no confidentiality loss; no public exploit identified at time of analysis, and the issue is remediated by the vendor-fixed version 6.7.260717.
OS command injection in ntopng prior to 6.7.260717 allows an authenticated non-administrator user to run arbitrary operating-system commands as the ntopng process account, because the vulnerability-scan REST endpoints accepted the scan_ports parameter without an administrator check and passed it through a validator that still permits shell metacharacters. Exploitation requires nmap to be present on the host, and a secondary no-credentials path exists: the affected endpoints accept GET requests while ntopng's CSRF validation only covers POST bodies, so a logged-in victim's browser can be induced to trigger the command. The vulnerability is rated CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code or KEV-listed active exploitation was identified at time of analysis, and the issue is fixed in 6.7.260717.
An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Lua 5.4.0 (fixed in 5.4.1) has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 10.6%.
Denial of service in the Lua language bindings of Apache Thrift allows unauthenticated remote attackers to exhaust CPU resources by supplying pathologically crafted input to a regular-expression or parsing code path in releases before 0.25.0, consistent with CWE-1333 (inefficient regular expression complexity). The CVSS 4.0 vector scores 8.2 with AT:P, indicating that a specific attack prerequisite must be met: the deployment must actually use the Lua bindings and attacker-controlled data must reach the vulnerable parsing path, so exploitation is not fully attacker-controlled. The vendor-released fix is Apache Thrift 0.25.0; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), with the effective risk concentrated in services that parse untrusted input through the Lua binding.
Command injection in the USB Device Management API (pop_usb_device) of the Ziroom ZHOME A0101 smart-home hub running firmware 1.0.1.0 lets a remote attacker who already holds administrator credentials execute arbitrary operating-system commands on the device by manipulating the 'path' argument. Publicly available exploit code exists (published with a write-up, and a PoC linked by VulDB), but there is no indication of confirmed active exploitation (not in CISA KEV). The practical exposure is gated by the need for a valid high-privilege admin session against the hub's LuCI web interface, which tempers the high CVSS 4.0 base score of 8.5.
Authenticated non-administrator users of ntopng prior to 6.7.260718 can list and download complete system-configuration backups through the REST v2 endpoints get/system/configurations/list_available_backups.lua and download_backup.lua, which lack the administrator authorization check that the vendor's fix adds. Because the backup payload includes the ntopng.user.* Redis key space, the downloaded archive routinely discloses local-user password hashes and, on deployments where those features are configured, API tokens, TOTP secrets and WebAuthn credential material - enabling account takeover via usable or crackable credentials. Exploitation requires only a valid low-privileged login (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N per independent assessment, PR:L means authenticated but not administrative), with no user interaction and no non-default configuration; no public exploit code or active-exploitation activity (CISA KEV) was identified at time of analysis. The vendor's own CVSS of 8.8 with I:H/A:H is judged slightly overstated, since the flaw is an information-disclosure primitive rather than direct integrity or availability loss.
Any authenticated but non-administrator user on ntopng deployments prior to 6.7.260717 can tamper with threat-intelligence blocklists through the REST endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua, which performed no administrator check before invoking lists_utils.editList. By manipulating the list_name, list_enabled, url, and list_update parameters, a low-privileged account can repoint blocklist downloads to attacker-controlled content, disable existing blocklists, or suppress scheduled updates, with the changes persisted in Redis and reloaded without a lower-level authorization guard. This yields high integrity and availability impact (CVSS 3.1 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) but no confidentiality loss; no public exploit identified at time of analysis, and the issue is remediated by the vendor-fixed version 6.7.260717.
OS command injection in ntopng prior to 6.7.260717 allows an authenticated non-administrator user to run arbitrary operating-system commands as the ntopng process account, because the vulnerability-scan REST endpoints accepted the scan_ports parameter without an administrator check and passed it through a validator that still permits shell metacharacters. Exploitation requires nmap to be present on the host, and a secondary no-credentials path exists: the affected endpoints accept GET requests while ntopng's CSRF validation only covers POST bodies, so a logged-in victim's browser can be induced to trigger the command. The vulnerability is rated CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code or KEV-listed active exploitation was identified at time of analysis, and the issue is fixed in 6.7.260717.
An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Lua 5.4.0 (fixed in 5.4.1) has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 10.6%.