A Rogue Minecraft-Style Mod Could Hijack Your Game — and Your Computer

A mod you downloaded to make your game look better could silently hand an attacker the keys to everything on your computer — and you'd never know it happened.

Who's at Risk — and How Big Is This?

Luanti (formerly Minetest) is a free, open-source voxel game engine — think Minecraft's spiritual open-source cousin — with a passionate global community of players and modders. The engine powers hundreds of community-made games and supports a sprawling ecosystem of user-created modifications (mods) that players routinely download from public repositories to change gameplay, add new content, or improve graphics.

Every installation of Luanti 5 prior to version 5.15.2 is potentially vulnerable. Given that Luanti is cross-platform and actively played on Windows, Linux, and macOS, the exposed population spans casual gamers, hobbyist developers, and educators who use Luanti as a teaching tool for game design. The vulnerability carries a CVSS score of 8.1 (HIGH), placing it firmly in the category of flaws that security teams treat as urgent — not hypothetical.

What's Actually Happening Here

To understand this flaw, you need to know one thing about how Luanti handles mods: it runs them inside a kind of walled garden. Mods are supposed to be sandboxed — isolated from sensitive system functions so that a sketchy mod can't, say, read your files or make network calls without permission. To get outside that walled garden, a mod has to be explicitly trusted by the server administrator. Admins can designate specific mods as "trusted" in the game's configuration file, essentially handing them a signed pass that says: this mod is allowed to talk to the outside world.

Here's where the attack unfolds. The moment an administrator trusts even one legitimate mod — a popular map-generator, say, or a networking utility — a cleverly crafted malicious mod can intercept the process by which that trusted mod requests its elevated access. It's a bit like a thief who watches a trusted employee badge through a secure door, then catches the door before it closes and slips through behind them. The malicious mod didn't earn the trust. It just exploited the moment the door was open for someone who did. Once inside, the attacker's mod gains the same unrestricted access that was intended only for the trusted mod — including the ability to make arbitrary HTTP requests, interact with the system environment, and potentially execute code well outside the game's intended boundaries.

The real-world attack scenario is uncomfortably plausible. A malicious actor publishes a mod on a community repository — something innocuous-sounding like an inventory enhancement or a lighting pack. A server admin installs it alongside already-trusted mods. The game launches, the trusted mod requests its sandbox pass, the malicious mod intercepts the handoff, and the attacker now has a foothold on the server host's machine or any connected client configured to run that mod. No exploits, no zero-days required on the operating system layer — just a flaw in how the engine manages its own trust chain.

The Technical Anchor: Sandbox Privilege Escalation via Environment Request Interception

For the security researchers in the room: the vulnerability is classified as a sandbox escape via insecure environment privilege escalation. Specifically, the flaw lives in how Luanti resolves requests for the insecure environment object and HTTP API when secure.trusted_mods or secure.http_mods contain at least one entry. The request for the insecure environment is not sufficiently isolated from other mods loaded in the same context, allowing a crafted mod to interpose on that request and receive the privileged API handle that was never meant for it. This is fundamentally an API interception / confused deputy class vulnerability within the engine's Lua mod runtime — not a memory corruption bug, but a logic flaw in trust delegation. The attack surface exists on both game servers and local single-player instances where trusted mods are configured. CVSS 8.1 (HIGH), CVE-2026-40960.

Has This Been Exploited in the Wild?

As of publication, no confirmed active exploitation has been documented. There are no known threat campaigns, no reported victims, and no public proof-of-concept exploit code circulating in the wild. That's the good news. The sobering counterpoint: the attack concept is not especially complex, the Luanti mod ecosystem is open and easily accessible to anyone wanting to plant a malicious package, and the window between public disclosure and weaponization has historically been short for vulnerabilities of this clarity and severity.

The vulnerability was addressed by the Luanti development team in the 5.15.2 release. Security teams and server administrators should treat this as a narrow but closing window to patch before someone does the math on it.

What You Should Do Right Now

1. Update Luanti to version 5.15.2 or later — immediately.
   Head to luanti.org or your platform's package manager and confirm you are running 5.15.2+. If you manage a Luanti game server, this update is not optional. Check your version by launching the engine and inspecting the title screen version string, or run luanti --version from the command line. Any version of Luanti 5 below 5.15.2 is vulnerable.
2. Audit your secure.trusted_mods and secure.http_mods lists.
   Open your minetest.conf (or luanti.conf) configuration file and review every mod listed under these two directives. Remove any entries that are unfamiliar, were added without your direct knowledge, or come from unverified sources. The vulnerability requires at least one trusted mod to be present — so if you're running a server with a long list of trusted mods accumulated over time, now is the time to prune it to only what is strictly necessary.
3. Treat unverified mods as untrusted code — because that's exactly what they are.
   Until you patch, do not add any new mods to your trusted lists, and avoid downloading mods from informal or unvetted sources. After patching, apply the principle of least privilege going forward: only grant elevated access to mods you have personally reviewed or that come from the official Luanti ContentDB with a strong community reputation. Treat a mod requesting trusted status the same way you'd treat a browser extension requesting permission to read all your data — skeptically, and only when the reason is clear.

CVE-2026-40960 | CVSS 8.1 HIGH | Affects Luanti 5 < 5.15.2 | Patched in 5.15.2 | No active exploitation confirmed at time of publication.