LuaRocks Security Incident September 2026
LuaRocks.org was breached via an exploited rockspec bytecode RCE, exposing credentials and three malicious packages.
LuaRocks.org disclosed that a remote code execution flaw in rockspec parsing was exploited several times between July 9 and August 20, 2026, after a September 25 report coordinated through CISA. On LuaJIT, loadstring accepted precompiled bytecode, letting an uploaded rockspec escape the sandbox and run arbitrary code; the site was fixed September 26 by forcing text-only loads. The operators assume the attacker could read the database, including usernames, emails, bcrypt password hashes, API keys, 2FA secrets, and GitHub link tokens, all of which were revoked. Three attacker accounts published malicious packages bcrcewon, 7e0b94029db0, and 7e0b9402f9c8 on August 7; mirror comparisons found no tampering of existing packages.
- RCE on LuaRocks.org was exploited between July 9 and August 20, 2026.
- LuaJIT loadstring accepted bytecode, escaping the empty-environment sandbox.
- API keys, bcrypt password hashes, and 2FA secrets are treated as exposed.
- Attacker published three malicious packages on August 7; they were removed.
- No evidence existing packages were modified; credentials were revoked.
From the original article
5 min read at luarocks.orgOn September 25th, 2026 we received a report of a remote code execution vulnerability in LuaRocks. org, coordinated through CISA. The vulnerability was fixed on September 26th.
By luarocks.org via derp_alert · luarocks.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.