LuaRocks Breach: an RCE Found a Year Late, Exploited All Summer

On September 25, 2026, the LuaRocks team received a report — coordinated through CISA — of a remote code execution vulnerability on luarocks.org. It was fixed the next day, but the investigation revealed the flaw had already been abused: between July 9 and August 20, attackers repeatedly ran commands on the server.

Because an attacker could execute code, everything the server had access to is treated as exposed. The site was moved to a freshly built machine, and every credential the old server held has been revoked and replaced. No evidence was found that existing packages were modified.

The vulnerability

Rockspecs are Lua files. When one is uploaded, LuaRocks.org runs it in a restricted environment to read the package's name and version. But the loading function accepted precompiled LuaJIT bytecode as well as source text. LuaJIT does not verify bytecode, so a crafted file could read and write memory outside the sandbox and run arbitrary code inside the web server. Any registered user could trigger it. The fix now loads rockspecs as text only and rejects bytecode.

What happened

Three accounts created for the purpose carried out the attack. On July 9, shell commands were run through malicious uploads. On August 7 they were run again, including an apparent attempt to open a remote shell, and three malicious packages were published — bcrcewon, 7e0b94029db0 and 7e0b9402f9c8. On August 16 and 20, several hundred automated exploit attempts came through the upload API. The web server's account could gain full administrative rights, so the attacker is assumed to have read everything on it, including the entire database.

What was exposed

Usernames, email addresses and bcrypt password hashes, all API keys, two-factor authentication secrets, linked GitHub tokens, session records with IP addresses and browser details, and third-party service credentials are all considered exposed. Everything has since been revoked or removed.

What users should do

Create a new API key, log in again, change your password (and anywhere the same one was reused), and set up two-factor authentication afresh. Crucially, upgrade LuaRocks to 3.12 or newer: versions 3.11.1 and older on LuaJIT or Lua 5.1 will execute bytecode sent by a server in place of a rockspec or manifest. Anyone who installed one of the three malicious packages should treat that machine as compromised.

A daily git mirror of all packages let the team compare storage against its pre-attack state: no changes to others' packages, no persistence mechanisms, and no edits to the site's code were found. The team apologized for the flaw going unnoticed for so long and thanked the researcher who reported it.

Source: Lobsters