CVE-2024-45597

5.3 mediumEPSS 0.3%

Medium (5.3) in pluto-lang pluto. EPSS 0.3% chance of exploitation in the next 30 days.

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE: CWE-93
Published: 2024-09-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pluto-lang:pluto

References

https://github.com/PlutoLang/Pluto/pull/945
https://github.com/PlutoLang/Pluto/security/advisories/GHSA-w8xp-pmx2-37w7

Check your stack JSON