Luarocks.org remote code execution exploit

(vhyrro.neorg.org)

22 points | by cupcakerob 12 hours ago ago

1 comments

  • rurban 2 hours ago ago

    Oh oh, unsafe eval in a sandbox! (loadstring).

    In my lua-like sandbox I disabled all escape hatches and unsafe functions physically by #ifndef SANDBOX. No IO, no FFI, no byte code loading, no memory funcs and such.