CVE-2024-45597

Pluto (a Lua-based superset) is affected by CVE-2024-45597 due to scripts passing user-controlled values to http.request header values, which can allow an attacker to send arbitrary HTTP requests and potentially leverage authentication tokens in the same headers table. The issue is tied to header...