CVE-2023-32700

High

Description

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

SeverityHigh

CVSS7.8

Exploit probability—

ProductLuatex

PublishedMay 20, 2023

First seenMay 20, 2023

Weakness typeCWE-77Command injection

How to fix

Update

luatex_project luatex1.16.2 or later
miktex miktex23.5 or later
tug tex_live2023 or later

Vendor advisories

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLY43MIRONJSJVNBDFQHQ26MP3JIOB3H/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TF6YXUUFRGBIXIIIEV5SGBJXXT2SMUK5/

Affected products

Product	Affected versions	Fixed in
luatex_project luatex	1.04 ≤ v < 1.16.2	1.16.2
miktex miktex	2.9.6300 ≤ v < 23.5	23.5
tug tex_live	2017 ≤ v < 2023	2023

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.