CVE-2018-1999023: Wesnoth The Battle For Wesnoth

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be exploitable via Loading specially-crafted saved games, networked games, replays, and player content.

Affected products

• Wesnoth The Battle For Wesnoth: from 1.7.0, up to and including 1.14.3

Published 2018-07-23. Last modified 2026-06-17.