Last updated
Lua is a powerful, efficient, lightweight, embeddable scripting language. LuaRocks is the package manager for Lua modules.
$ winget install --id DEVCOM.Lua --exact --version 5.4.6Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.
Lua uses MSI (WiX). The silent install switches are /quiet /norestart.
msiexec.exe /i Lua-5.4.6-win64.msi /quiet /norestart
For IT teams
App deployment, patching, and remote support in one place. Push this app to every device you manage, keep it patched automatically, and see new CVEs the moment they land. Works with Intune or fully standalone.
Sign up freeFree for up to 5 devices.
| Architecture | Type | Scope | Install | Download |
|---|---|---|---|---|
| x64 | MSI WiX | - | Direct |
Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.
13 known CVEs via NVD
In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.
An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file.
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).
See a CVE that affects your fleet? Pckgr RMM flags vulnerable devices and pushes the patched version automatically - automated patching is the only way to keep up.
More from DEVCOM or browse language, programming, programming-language.