A crafted mod that exploits LuaJIT in Luanti allows a sandbox escape, giving an attacker the ability to execute arbitrary Lua code outside the intended safe environment. This flaw maps to CWE-829, exposing the application to excessive privilege gain during mod loading.

Luanti is impacted in all versions prior to 5.15.2. Users running Luanti 5.x with LuaJIT enabled are at risk.

The vulnerability has a CVSS score of 9.3, indicating critical severity, and is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data is unavailable, but the lack of mitigation in the community suggests the risk remains high. The likely attack vector is the deployment of a crafted mod in environments where LuaJIT is enabled; this inference is based on the description of a sandbox escape via a crafted module.