8.8

CVE-2023-32700: luatex_project luatex Command Injection

CVSS: 8.8v3.1HighModified
AliasesMGASA-2023-0233SUSE-SU-2023:2284-1SUSE-SU-2023:2285-1
Published 20-05-2023Last modified 31-01-2025
Open JSON

Vulnerability summary

CVE-2023-32700 is a high (CVSS 8.8) Command Injection vulnerability in luatex_project luatex. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 55.9% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.80%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
OPENSUSE-SU-2024:12936-1SUSE-SU-2023:2287-1

Timeline

  1. 20-05-2023
    PublishedVulnerability first disclosed.
  2. 31-01-2025
    Last modifiedVulnerability information updated.

Description

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.80%

Chance of exploitation in the next 30 days

Percentile

56%

Versus all other CVEs

30-day change

0.00 pp

From 0.80% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.80%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat193 products
  • texlive< 7:20180414-15.el8_1 | < 7:20180414-15.el8_2 | < 7:20180414-21.el8_4 | < 7:20180414-26.el8_6 | < 7:20180414-29.el8_8 | < 9:20200406-26.el9_0 | < 9:20200406-26.el9_2
  • texlive-adjustbox< 7:20180414-15.el8_1 | < 7:20180414-15.el8_2 | < 7:20180414-21.el8_4 | < 7:20180414-26.el8_6 | < 7:20180414-29.el8_8 | < 9:20200406-26.el9_0 | < 9:20200406-26.el9_2
  • texlive-ae< 7:20180414-15.el8_1 | < 7:20180414-15.el8_2 | < 7:20180414-21.el8_4 | < 7:20180414-26.el8_6 | < 7:20180414-29.el8_8 | < 9:20200406-26.el9_0 | < 9:20200406-26.el9_2
  • texlive-algorithms< 7:20180414-15.el8_1 | < 7:20180414-15.el8_2 | < 7:20180414-21.el8_4 | < 7:20180414-26.el8_6 | < 7:20180414-29.el8_8 | < 9:20200406-26.el9_0 | < 9:20200406-26.el9_2
  • texlive-alphalph< 9:20200406-26.el9_0 | < 9:20200406-26.el9_2
Opensuse2 products
  • texlive&distro=openSUSE Leap 15.4< 2021.20210325-150400.31.3.1 | < 2017.20170520-150200.21.4.1
  • texlive&distro=openSUSE Leap 15.5< 2021.20210325-150400.31.3.1
Debian1 product
  • texlive-bin< 2022.20220321.62855-5.1 | < 2020.20200327.54578-7+deb11u1 | < 2018.20181218.49446-1+deb10u1
Luatex_project1 product
Mageia1 product
  • texlive< 20200406-9.1.mga8
Miktex1 product
Ubuntu1 product
  • texlive-bin< 2017.20170613.44572-8ubuntu0.2 | < 2019.20190605.51237-3ubuntu0.1 | < 2021.20210626.59705-1ubuntu0.1

7 vendors · 200 products · Showing 200 of 421. Use Open JSON for the complete list.

References

24 links
Show all 24 references