PT-2026-47116 · Julia · Lua Jll

Published 2026-05-26 · Updated 2026-05-26

OSV

Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file.

Related Identifiers

JLSEC-2026-558

Affected Products

Lua Jll

References · 6

• https://osv.dev/vulnerability/JLSEC-2026-558 · Vendor Advisory
• https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerability · Note
• http://lua-users.org/lists/lua-l/2021-11/msg00186.html · Note
• http://lua-users.org/lists/lua-l/2021-12/msg00030.html · Note
• http://lua-users.org/lists/lua-l/2021-12/msg00007.html · Note
• http://lua-users.org/lists/lua-l/2021-12/msg00015.html · Note