CVE-2018-1999023

Name of the Vulnerable Software and Affected Versions The Battle for Wesnoth Project versions 1.7.0 through 1.14.3

Description The issue concerns a Code Injection vulnerability in the Lua scripting engine, which can lead to code execution outside the sandbox. This can be exploited by loading specially-crafted saved games, networked games, replays, and player content.

Recommendations For versions 1.7.0 through 1.14.3, consider disabling the Lua scripting engine as a temporary workaround until a patch is available. Restrict access to loading saved games, networked games, replays, and player content from untrusted sources to minimize the risk of exploitation.