CVE catalog

CVE-2022-35978

minetest affected and fixed versions

Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.

Severity: Critical · CVSS 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: Jan 1, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 3.12% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debianbookworm	minetest	`5.5.0+dfsg+~1.9.0mt4+dfsg-2`	FixedDistribution-reported fixed boundary	[CVE-2022-35978]
Debianbookworm	minetest	`5.6.1+dfsg+~1.9.0mt8+dfsg-2`	Fixed	[CVE-2022-35978]

Showing 2 fix observations. All 18 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	minetest	`5.5.0+dfsg+~1.9.0mt4+dfsg-2`	FixedDistribution-reported fixed boundary	[CVE-2022-35978]
Debianbookworm	minetest	`5.6.1+dfsg+~1.9.0mt8+dfsg-2`	Fixed	[CVE-2022-35978]
Opensuseleap 15.3	minetest	`5.6.0-bp154.2.3.5`	UnknownSource applicability is not established	[OPENSUSE-SU-2023:0001-1]Feb 4, 2026, 2:54:27 AM UTC
Opensuseleap 15.4	minetest	`5.6.0-bp154.2.3.5`	UnknownSource applicability is not established	[OPENSUSE-SU-2023:0001-1]Feb 4, 2026, 2:54:27 AM UTC
Opensusetumbleweed	luanti	`5.11.0-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2025:14825-1]Feb 4, 2026, 3:46:16 AM UTC
Susepackage hub 15 sp3	minetest	`5.6.0-bp154.2.3.5`	UnknownSource applicability is not established	[OPENSUSE-SU-2023:0001-1]Feb 4, 2026, 2:54:27 AM UTC
Susepackage hub 15 sp4	minetest	`5.6.0-bp154.2.3.5`	UnknownSource applicability is not established	[OPENSUSE-SU-2023:0001-1]Feb 4, 2026, 2:54:27 AM UTC
Ubuntu16.04	minetest	`0.4.12+repack-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-35978]Sep 7, 2026, 2:06:15 PM UTC
Ubuntu16.04	minetest	`0.4.13+repack-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-35978]Sep 7, 2026, 2:06:15 PM UTC
Ubuntu16.04	minetest	`0.4.13+repack-1build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-35978]Sep 7, 2026, 2:06:15 PM UTC
Ubuntu18.04	minetest	`0.4.16+repack-3`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-35978]Sep 7, 2026, 2:06:15 PM UTC
Ubuntu18.04	minetest	`0.4.16+repack-4`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-35978]Sep 7, 2026, 2:06:15 PM UTC
Ubuntupro	minetest	`5.6.1+dfsg+~1.9.0mt8+dfsg-2build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-35978]Sep 7, 2026, 2:06:15 PM UTC
Ubuntupro	minetest	`5.6.1+dfsg+~1.9.0mt8+dfsg-3`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-35978]Sep 7, 2026, 2:06:15 PM UTC
Ubuntupro	minetest	`5.6.1+dfsg+~1.9.0mt8+dfsg-4`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-35978]Sep 7, 2026, 2:06:15 PM UTC
Ubuntupro	minetest	`5.6.1+dfsg+~1.9.0mt8+dfsg-4build2`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-35978]Sep 7, 2026, 2:06:15 PM UTC
Ubuntupro	minetest	`5.6.1+dfsg+~1.9.0mt8+dfsg-4build3`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-35978]Sep 7, 2026, 2:06:15 PM UTC
Ubuntupro	minetest	`5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2022-35978]Sep 7, 2026, 2:06:15 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "minetest",
      "status": "fixed",
      "release": "bookworm",
      "version": "5.6.1+dfsg+~1.9.0mt8+dfsg-2"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1017548,
      "name": "minetest",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "5.5.0+dfsg+~1.9.0mt4+dfsg-2"
    }
  ],
  "distribution_packages": [
    {
      "name": "minetest",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "0.4.12+repack-2ubuntu1",
        "0.4.13+repack-1",
        "0.4.13+repack-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-35978",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-35978",
      "provider_updated_at": "2026-09-07T14:06:15.345922144Z",
      "applicability_unknown": true
    },
    {
      "name": "minetest",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "0.4.16+repack-3",
        "0.4.16+repack-4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-35978",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-35978",
      "provider_updated_at": "2026-09-07T14:06:15.345922144Z",
      "applicability_unknown": true
    },
    {
      "name": "minetest",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "5.6.1+dfsg+~1.9.0mt8+dfsg-2build1",
        "5.6.1+dfsg+~1.9.0mt8+dfsg-3",
        "5.6.1+dfsg+~1.9.0mt8+dfsg-4",
        "5.6.1+dfsg+~1.9.0mt8+dfsg-4build2",
        "5.6.1+dfsg+~1.9.0mt8+dfsg-4build3",
        "5.6.1+dfsg+~1.9.0mt8+dfsg-4ubuntu0.1~esm1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-35978",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-35978",
      "provider_updated_at": "2026-09-07T14:06:15.345922144Z",
      "applicability_unknown": true
    },
    {
      "name": "luanti",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.11.0-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2025:14825-1",
      "fixed_version": "5.11.0-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2025:14825-1",
      "provider_updated_at": "2026-02-04T03:46:16.258295Z",
      "applicability_unknown": true
    },
    {
      "name": "minetest",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.0-bp154.2.3.5"
            }
          ]
        }
      ],
      "release": "package hub 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2023:0001-1",
      "fixed_version": "5.6.0-bp154.2.3.5",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2023:0001-1",
      "provider_updated_at": "2026-02-04T02:54:27.311104Z",
      "applicability_unknown": true
    },
    {
      "name": "minetest",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.0-bp154.2.3.5"
            }
          ]
        }
      ],
      "release": "package hub 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2023:0001-1",
      "fixed_version": "5.6.0-bp154.2.3.5",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2023:0001-1",
      "provider_updated_at": "2026-02-04T02:54:27.311104Z",
      "applicability_unknown": true
    },
    {
      "name": "minetest",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.0-bp154.2.3.5"
            }
          ]
        }
      ],
      "release": "leap 15.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2023:0001-1",
      "fixed_version": "5.6.0-bp154.2.3.5",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2023:0001-1",
      "provider_updated_at": "2026-02-04T02:54:27.311104Z",
      "applicability_unknown": true
    },
    {
      "name": "minetest",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.0-bp154.2.3.5"
            }
          ]
        }
      ],
      "release": "leap 15.4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2023:0001-1",
      "fixed_version": "5.6.0-bp154.2.3.5",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2023:0001-1",
      "provider_updated_at": "2026-02-04T02:54:27.311104Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1017548]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[minetest]Unknown
Details (2)
- 5.6.1+dfsg+~1.9.0mt8+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 5.5.0+dfsg+~1.9.0mt4+dfsg-2
  dsa · minetest · debian · bookworm
- 5.6.1+dfsg+~1.9.0mt8+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 5.5.0+dfsg+~1.9.0mt4+dfsg-2
  dsa · minetest · debian · bookworm
[minetest-data]Unknown
Source package: [minetest]
Details (2)
- 5.6.1+dfsg+~1.9.0mt8+dfsg-2 · all · bookworm
  Fixed · Fixed: 5.5.0+dfsg+~1.9.0mt4+dfsg-2
  dsa · minetest · debian · bookworm
- 5.6.1+dfsg+~1.9.0mt8+dfsg-2 · all · bookworm
  Fixed · Fixed: 5.5.0+dfsg+~1.9.0mt4+dfsg-2
  dsa · minetest · debian · bookworm
[minetest-server]Unknown
Source package: [minetest]
Details (2)
- 5.6.1+dfsg+~1.9.0mt8+dfsg-2 · amd64 · bookworm
  Fixed · Fixed: 5.5.0+dfsg+~1.9.0mt4+dfsg-2
  dsa · minetest · debian · bookworm
- 5.6.1+dfsg+~1.9.0mt8+dfsg-2 · arm64 · bookworm
  Fixed · Fixed: 5.5.0+dfsg+~1.9.0mt4+dfsg-2
  dsa · minetest · debian · bookworm

[openSUSE Tumbleweed]

[luanti]Unknown
Source package: [luanti]
Details (1)
- 5.17.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 5.11.0-1.1
  dsa · luanti · opensuse · tumbleweed
[luanti-data]Unknown
Source package: [luanti]
Details (1)
- 5.17.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 5.11.0-1.1
  Version impact unknown
  dsa · luanti · opensuse · tumbleweed
[luanti-lang]Unknown
Source package: [luanti]
Details (1)
- 5.17.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 5.11.0-1.1
  Version impact unknown
  dsa · luanti · opensuse · tumbleweed
[luantiserver]Unknown
Source package: [luanti]
Details (1)
- 5.17.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 5.11.0-1.1
  Version impact unknown
  dsa · luanti · opensuse · tumbleweed

Observed: Oct 28, 2026, 6:17:03 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]