CVE-2024-39840

2024-06-2917:15:09

[email protected]

web.nvd.nist.gov

factorio

crafted server

execute arbitrary code

clients

custom map

lua base module functions

bytecode

fake objects

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages the ability of certain Lua base module functions to execute bytecode and generate fake objects.

References

memorycorruption.net/posts/rce-lua-factorio/

news.ycombinator.com/item?id=40830005