Multiple issues have been found in libinput: 1) CVE-2026-35093: Sandbox escape in libinput plugins The libinput plugin system provides a sandbox to any Lua plugins to restrict them from any IO other than log messages. However, a bug in the plugin system loader allowed for precompiled byte-code to be loaded.
| Vendor | Product | Versions |
|---|---|---|
| libinput | Lua Handler | — |
Updated description with details about CVE-2026-35093 and marked exploit availability as true.
Updated vendor to libinput, product to Lua Handler, changed severity to CRITICAL, and noted that no exploit exists.
Initial creation
