PatchTheCVEluatex vulnerabilities and fixes
Recent CVEs affecting luatex, with upgrade or downgrade steps. 2 tracked.
luatex has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2023-05-20. Highest priority: CVE-2023-32700 (score 42/100).
- CVE-2023-32700 HIGH 7.8 UPGRADE UPGRADE LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an u
- CVE-2023-32668 MEDIUM 5.5 UPGRADE UPGRADE LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests
FAQ
How do I fix luatex vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is luatex being exploited right now?
None of the tracked luatex CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which luatex CVE should I patch first?
CVE-2023-32700 currently ranks highest (42/100): LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an u.