LuaRocks.org

A critical remote code execution vulnerability affecting LuaRocks.org, the package repository for the Lua programming language, has been publicly disclosed. The writeup, published by a Neorg developer, describes how the flaw could let an attacker run arbitrary code through the package infrastructure. Discussion is focused on the severity of the bug, whether it was exploited in practice, and what it means for supply-chain security across open-source package repositories.