How severe is CVE-2022-35978?

CVE-2022-35978 has a CVSS 3.x base score of 7.7, rated high severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.

Is CVE-2022-35978 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-35978?

CVE-2022-35978 affects Minetest. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-35978?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2022-35978 published?

CVE-2022-35978 was published on 2022-08-15 and last updated on 2026-06-17.

CVE-2022-35978

CVE-2022-35978 is a high-severity vulnerability in Minetest with a CVSS 3.x base score of 7.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-693.

Key facts

Severity: High (CVSS 3.x base score 7.7)
EPSS exploit prediction: 2% (80th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-693
Affected product: Minetest
Published: 2022-08-15
Last modified: 2026-06-17

Description

Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.

Frequently asked questions

What is CVE-2022-35978?: Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.
How severe is CVE-2022-35978?: CVE-2022-35978 has a CVSS 3.x base score of 7.7, rated high severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.
Is CVE-2022-35978 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-35978?: CVE-2022-35978 affects Minetest. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-35978?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2022-35978 published?: CVE-2022-35978 was published on 2022-08-15 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:minetest:minetest:*:*:*:*:*:*:*:*

More vulnerabilities in Minetest

CVE-2026-41196 — Critical (CVSS 10.0): Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to…
CVE-2022-24300 — Critical (CVSS 9.8): Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user…
CVE-2022-24301 — Medium (CVSS 6.5): In Minetest before 5.4.0, players can add or subtract items from a different player's inventory.

All CVEs affecting Minetest →

Other CWE-693 (Protection Mechanism Failure) vulnerabilities

CVE-2026-47140 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins…
CVE-2026-34208 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects…
CVE-2026-34938 — Critical (CVSS 10.0): PraisonAI is a multi-agent teams system. Prior to version 1.5.90, execute_code() in praisonai-agents runs…
CVE-2026-2761 — Critical (CVSS 10.0): Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33,…
CVE-2022-32845 — Critical (CVSS 10.0): This issue was addressed with improved checks. This issue is fixed in watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS…
CVE-2026-45102 — Critical (CVSS 9.9): OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm…

Browse all CWE-693 (Protection Mechanism Failure) vulnerabilities →