CVE-2023-32700

—

CVSS 3.1

7.8 high

EPSS

<1%p55

Published

May 20, 2023 (May 20, 2023)

Modified

Jun 17, 2026

Description

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

Vendors: luatex project miktex tug
Products: luatex, miktex, tex live
Weakness: CWE-77
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.