CVE-2023-32668

5.5 MEDIUM
Published: May 11, 2023 Modified: November 03, 2025
View on NVD

Description

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/blob/b266ef076c96b382cd23a4c93204e247bb98626a/source/texk/web2c/luatexdir/ChangeLog#L1-L3
Source: cve@mitre.org
Release Notes
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0
Source: cve@mitre.org
Patch
https://tug.org/pipermail/tex-live/2023-May/049188.html
Source: cve@mitre.org
Issue Tracking Mailing List Mitigation
https://tug.org/~mseven/luatex.html#luasocket
Source: cve@mitre.org
Exploit Vendor Advisory
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/blob/b266ef076c96b382cd23a4c93204e247bb98626a/source/texk/web2c/luatexdir/ChangeLog#L1-L3
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
https://gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
https://lists.debian.org/debian-lts-announce/2024/10/msg00032.html
Source: af854a3a-2127-422b-91ae-364da2661108
https://tug.org/pipermail/tex-live/2023-May/049188.html
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking Mailing List Mitigation
https://tug.org/~mseven/luatex.html#luasocket
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Vendor Advisory

9 reference(s) from NVD

Quick Stats

CVSS v3 Score
5.5 / 10.0
EPSS (Exploit Probability)
0.1%
21th percentile
Exploitation Status
Not in CISA KEV

Affected Vendors

luatex_project miktex tug