CVE-2023-32668

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-05-11 · updated 2026-06-17

Description

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

Affected products

Luatex Project Luatex: from 0.27.0 before 1.17.0 — fixed in 1.17.0
Miktex: from 2.9.0 before 23.5 — fixed in 23.5
Tug Tex Live: from 2009 before 2023 — fixed in 2023

How to fix

Upgrade to a fixed version: Luatex Project Luatex 1.17.0; Miktex 23.5; Tug Tex Live 2023. Check the vendor advisory for mitigations.

References

https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/blob/b266ef076c96b382cd23a4c93204e247bb98626a/source/texk/web2c/luatexdir/ChangeLog#L1-L3
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0
https://tug.org/pipermail/tex-live/2023-May/049188.html
https://tug.org/~mseven/luatex.html#luasocket
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/blob/b266ef076c96b382cd23a4c93204e247bb98626a/source/texk/web2c/luatexdir/ChangeLog#L1-L3
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0
https://lists.debian.org/debian-lts-announce/2024/10/msg00032.html
https://tug.org/pipermail/tex-live/2023-May/049188.html
https://tug.org/~mseven/luatex.html#luasocket

Get alerted when CVE-2023-32668 or the next vulnerability affects your stack