CVE-2020-11722: 
Linux Debian vulnerability analysis and mitigation

Dungeon Crawl Stone Soup (DCSS or crawl) before version 0.25 contained a remote code execution vulnerability (CVE-2020-11722) that allowed attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc configuration file (NVD, Security Blog).

The vulnerability existed due to insufficient restrictions on Lua function calls within user-supplied Lua scripts. The game's .crawlrc configuration files could include Lua 5.1 scripts, and the global environment for these scripts included the load and loadstring functions that could process both Lua scripts and bytecode. Although Lua 5.1 included a bytecode verifier, known weaknesses in that verifier could be exploited. The vulnerability received a CVSS v3.1 Base Score of 9.8 CRITICAL (NVD).

A successful exploit could allow remote attackers to achieve arbitrary code execution on affected systems. The vulnerability could be exploited on any public DCSS server regardless of operating system, though specific exploit modifications were needed for different architectures (Security Blog).

The vulnerability was fixed in DCSS version 0.25 through two commits that disabled Lua bytecode loading. The fixes included blocking bytecode chunks (which begin with byte 0x1b) and disabling the load() and loadstring() functions (GitHub Commit, GitHub Commit).