CVE-2023-32700: Luatex Project Luatex

High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days.

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

Affected products

• Luatex Project Luatex: from 1.04, before 1.16.2 (fixed in 1.16.2)
• Miktex Miktex: from 2.9.6300, before 23.5 (fixed in 23.5)
• Tug Tex Live: from 2017, before 2023 (fixed in 2023)

Published 2023-05-20. Last modified 2026-06-17.