CVE-2023-32668

PoC —

CVSS 3.1

5.5 medium

EPSS

<1%p30

Published

May 11, 2023 (May 11, 2023)

Modified

Jun 17, 2026

Description

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

Vendors: luatex project miktex tug
Products: luatex, miktex, tex live
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.