CVE-2023-32700

CVE-2023-32700 affects LuaTeX up to 1.17.0, where luatex-core.lua allows access to the original io.popen, enabling arbitrary shell command execution when compiling TeX from untrusted sources. Impact commonly quoted: TeX Live before 2023 r66984 and MiKTeX before 23.5 are affected. Affected TeX Liv...

CVE-2023-32668

The CVE-2023-32668 issue affects LuaTeX and TeX Live components: LuaTeX prior to 1.17.0 (with default socket library access) allows a document to initiate arbitrary network requests, with TeX Live before 2023 r66984 and MiKTeX before 23.5 also affected. Underlying cause is default full access to ...