A security researcher discovered a critical remote code execution vulnerability in luarocks.org, a major Lua package repository, that could be exploited by regular users to gain root access and potentially execute a supply chain attack affecting millions of machines. The vulnerability stems from unsafe handling of rockspec files, which are Lua scripts that can execute arbitrary system commands if not properly sandboxed.
LuaRocks.org suffered a remote code execution vulnerability exploited between July and August 2026, affecting user credentials and API keys. The vulnerability in rockspec loading allowed arbitrary bytecode execution; the site was rebuilt, all credentials revoked, and users are advised to update passwords, API keys, and two-factor authentication. No evidence of package modification was found.