PT-2022-23076 · Minetest+2 · Minetest+2

Highsfan5 · Published 2022-08-06 · Updated 2025-02-20 · CVE-2022-35978

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Minetest versions prior to 5.6.1

Description The issue concerns a security vulnerability in Minetest, a free open-source voxel game engine, where a mod in single-player mode can set a global setting to control the Lua script loaded for the main menu. This script is loaded upon exiting the game session, and since the Lua environment is not sandboxed, it can directly interfere with the user's system. There are currently no known workarounds for this issue.

Recommendations For versions prior to 5.6.1, update to version 5.6.1 to resolve the issue. As a temporary workaround, consider disabling the use of mods in single-player mode until the update can be applied. Restrict access to the Lua script loaded for the main menu to minimize the risk of exploitation. Avoid using mods that could potentially set malicious global settings for the main menu script.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

ALT-PU-2022-2357

ALT-PU-2022-2540

CVE-2022-35978

GHSA-663Q-PCJW-27CC

MGASA-2023-0005

OPENSUSE-SU-2023:0001-1

OPENSUSE-SU-2024:12284-1

OPENSUSE-SU-2025:14825-1

Affected Products

Alt Linux

Debian

Minetest

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35978.json · Exploit
• https://github.com/minetest/minetest/commit/da71e86633d0b27cd02d7aac9fdac625d141ca13 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2023:0001-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14825-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-35978 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-35978 · Vendor Advisory
• https://dev.minetest.net/Changelog#5.5.0_.E2.86.92_5.6.0 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0005 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35978 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-35978 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-35978 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-35978 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35978 · Security Note
• https://advisories.mageia.org/MGASA-2023-0005.html · Security Note
• https://github.com/minetest/minetest/security/advisories/GHSA-663q-pcjw-27cc · Note