{"id":"CVE-2022-24300","details":"Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.","aliases":["GHSA-hwj2-xf72-r4cf"],"modified":"2026-08-12T13:00:00.666511Z","published":"2022-02-02T06:01:04Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24300.json"},"references":[{"type":"WEB","url":"https://bugs.debian.org/1004223"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24300.json"},{"type":"ADVISORY","url":"https://github.com/minetest/minetest/security/advisories/GHSA-hwj2-xf72-r4cf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24300"},{"type":"ADVISORY","url":"https://www.debian.org/security/2022/dsa-5075"},{"type":"FIX","url":"https://github.com/minetest/minetest/commit/b5956bde259faa240a81060ff4e598e25ad52dae"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/luanti-org/luanti","events":[{"introduced":"0"},{"fixed":"f3e51dca155ce1d1062a339cf925f41d7c751df8"},{"fixed":"b5956bde259faa240a81060ff4e598e25ad52dae"}],"database_specific":{"cpe":"cpe:2.3:a:minetest:minetest:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.4.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["5.3.0","5.2.0","5.1.0","5.0.0","0.4.16","0.4.15","0.4.14","0.4.13","0.4.11","0.4.10","0.4.9","0.4.8","0.4.4","0.4.3","0.4.2-rc1","0.4.1","0.4.0","0.4.dev-20120606","0.4.dev-20120603","0.3.1","0.4.dev-20120408","0.4.dev-20120326","0.4.dev-20120320","0.4.dev-20120318","0.4.dev-20120122-1","0.4.dev-20120106-1","0.4.dev-20111209-1","0.4.dev-20111204-1","0.4.dev-20111203-3","0.4.dev-20111203-2","0.4.dev-20111203-1","0.4.dev-20111202-1","0.4.dev-20111201-0","0.3.0","0.3.dev-20111021","0.2.20110922_1","0.2.20110922","0.2.20110731_3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24300.json","vanir_signatures_modified":"2026-08-12T13:00:00Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"53408133224196420866388612428380162363","length":196},"id":"CVE-2022-24300-1938ff24","signature_type":"Function","signature_version":"v1","source":"https://github.com/luanti-org/luanti/commit/b5956bde259faa240a81060ff4e598e25ad52dae","target":{"file":"src/itemstackmetadata.cpp","function":"ItemStackMetadata::setString"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/luanti-org/luanti/commit/b5956bde259faa240a81060ff4e598e25ad52dae","target":{"file":"src/itemstackmetadata.cpp"},"deprecated":false,"digest":{"line_hashes":["139091593272906886536187692800344746310","147833175575904894199468214698151422506","285130253436111299565579533393835422191","136955139694349349319049353098607610634","232826309761223626484778440077722443760","229672279112784701421788494966258695778","119741633168882156739549111384133518796","59095601892421019714297209725059810961","315452706849647259784930325093990111991","220448486910237519561833148909854796795"],"threshold":0.9},"id":"CVE-2022-24300-2edc632b"}]}}],"schema_version":"1.9.0"}