What’s Vulnerable › Vulnerabilities

CVE-2024-45597: Pluto's http.request allows CR and LF in header values

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-10 · updated 2026-06-17
• Weakness: CWE-93

Description

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table.

Affected products

• PlutoLang Pluto: from 0.9.0 before 0.9.5 — fixed in 0.9.5

How to fix

Upgrade to a fixed version: PlutoLang Pluto 0.9.5. Check the vendor advisory for mitigations.

References

• https://github.com/PlutoLang/Pluto/pull/945
• https://github.com/PlutoLang/Pluto/security/advisories/GHSA-w8xp-pmx2-37w7

Get alerted when CVE-2024-45597 or the next vulnerability affects your stack