CVE-2023-32700

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-20 · updated 2026-06-17
Weakness: CWE-77

Description

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

Affected products

Luatex Project Luatex: from 1.04 before 1.16.2 — fixed in 1.16.2
Miktex: from 2.9.6300 before 23.5 — fixed in 23.5
Tug Tex Live: from 2017 before 2023 — fixed in 2023

How to fix

Upgrade to a fixed version: Luatex Project Luatex 1.16.2; Miktex 23.5; Tug Tex Live 2023. Check the vendor advisory for mitigations.

References

https://github.com/TeX-Live/texlive-source/releases/tag/build-svn66984
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLY43MIRONJSJVNBDFQHQ26MP3JIOB3H/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TF6YXUUFRGBIXIIIEV5SGBJXXT2SMUK5/
https://tug.org/pipermail/tex-live/2023-May/049188.html
https://tug.org/~mseven/luatex.html
https://github.com/TeX-Live/texlive-source/releases/tag/build-svn66984
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLY43MIRONJSJVNBDFQHQ26MP3JIOB3H/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TF6YXUUFRGBIXIIIEV5SGBJXXT2SMUK5/
https://tug.org/pipermail/tex-live/2023-May/049188.html
https://tug.org/~mseven/luatex.html

Get alerted when CVE-2023-32700 or the next vulnerability affects your stack