Medium severity5.5NVD Advisory· Published May 11, 2023· Updated Jun 17, 2026

CVE-2023-32668

Description

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full access to the socket library is permitted by default, as stated in the documentation. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

LuaTeX/LuaTeXllm-fuzzy2 versions
<1.17.0+ 1 more
- (no CPE)range: <1.17.0
- (no CPE)
osv-coords
pkg:rpm/opensuse/texlive&distro=openSUSE%20Tumbleweed
Range: < 2023.20230311.svn34398-90.1
TeXLive/Texlivellm-fuzzy
Range: <2023 r66984
MiKTeX/MiKTeXllm-fuzzy2 versions
<23.5+ 1 more
- (no CPE)range: <23.5
- cpe:2.3:a:miktex:miktex:*:*:*:*:*:*:*:*range: >=2.9.0,<23.5
Luatex Project/Luatex
cpe:2.3:a:luatex_project:luatex:*:*:*:*:*:*:*:*
Range: >=0.27.0,<1.17.0
Tug/Texlive
cpe:2.3:a:tug:tex_live:*:*:*:*:*:*:*:*
Range: >=2009,<2023

Patches

Vulnerability mechanics

References

gitlab.lisn.upsaclay.fr/texlive/luatex/-/tags/1.17.0nvdPatch
tug.org/~mseven/luatex.htmlnvdExploitVendor Advisory
gitlab.lisn.upsaclay.fr/texlive/luatex/-/blob/b266ef076c96b382cd23a4c93204e247bb98626a/source/texk/web2c/luatexdir/ChangeLognvdRelease Notes
tug.org/pipermail/tex-live/2023-May/049188.htmlnvdIssue TrackingMailing ListMitigation
lists.debian.org/debian-lts-announce/2024/10/msg00032.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000