Luanti (formerly Minetest) v5.15.2 brings critical security updates

Luanti (formerly Minetest) is the popular free and open source voxel game engine powering some really fun experiences and a critical update is out now.

It's not a game by itself, Luanti is more of a platform / game engine. You can play games like VoxeLibre, which is very similar to Minecraft. A good alternative to Minecraft if you're looking for something even more moddable and completely free.

If you or anyone you know regularly play, you'll want to ensure you grab the newly released version 5.15.2 as soon as possible. Two critical security issues were found and fixed with this release. These include:

HTTP API and insecure environment access control bypass

If at least one mod is listed as secure.trusted_mods / secure.http_mods, then a malicious mod can intercept the request for the insecure environment / HTTP API, and also receive access to it.

Mod security sandbox escape

A malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user's device.
This applies to the server-side mod, async and mapgen as well as the client-side (CSM) environments.

This vulnerability is only exploitable when using LuaJIT. You can use luanti --version to determine the type of Lua in use.

Source: Changelog