CVE-2026-34444: Lupa Luaruntime Attribute Filter Without Register Builtins Falsecve-2026-34444-lupa-luaruntime-attribute-filter-without-register-builtins-false
LuaRuntime is configured with attribute access control (attribute_filter or attribute_handlers) but register_builtins=False is not set. Python builtins accessible as python.builtins.* inside Lua — including getattr, setattr, eval, and exec — bypass the attribute filter entirely by invoking CPython natively, skipping Lupa's proxy metamethods. This allows sand