CVE-2023-32700

What it actually does

The vulnerability exposes the original io.popen function in luatex-core.lua, allowing Lua code embedded in a TeX document to execute arbitrary operating system shell commands during compilation.

Why it matters to the business

Systems that compile TeX files from untrusted or external sources risk full compromise of the processing host, enabling data theft, malware deployment, or lateral movement; urgency is moderate given low exploit maturity and no known active campaigns.

How an attack unfolds

An attacker crafts a TeX document containing Lua code that invokes the exposed io.popen to run shell commands; when a victim compiles the file with a vulnerable LuaTeX binary the commands execute with the privileges of the compilation process.

How to fix it

Upgrade tex-live/texlive-source to commit 871c7a2856d70e1a9703d1f72f0587b9995dba5f or later; update LuaTeX to 1.17.0+, TeX Live to 2023 r66984+, and MiKTeX to 23.5+; restrict compilation of documents from untrusted sources until patched.

How to confirm the fix worked

Verify the installed LuaTeX version reports 1.17.0 or newer, confirm TeX Live revision is at or above r66984, and test that io.popen is no longer reachable from document Lua code.

Typical attack path

1. attacker prepares malicious TeX file containing Lua code that calls io.popen
2. victim obtains and compiles the file using vulnerable LuaTeX, TeX Live, or MiKTeX
3. Lua interpreter executes attacker-supplied shell commands during document processing
4. attacker gains code execution on the host

How to detect it

Monitor process creation logs for LuaTeX or luatex binaries spawning unexpected child processes such as shells or system utilities; review file access and command-line arguments of TeX compilation jobs that originate from untrusted directories.

What your security team should do

• Immediately upgrade all LuaTeX, TeX Live, and MiKTeX installations to the fixed versions listed
• Implement policy to sandbox or block compilation of TeX files from unknown origins
• Add version checks for LuaTeX binaries to vulnerability scanning and asset inventory