BYTECODE BREAKDOWN: UNRAVELING FACTORIO'S LUA SECURITY FLAWS

Summary from the TLDR Web Dev newsletter

Factorio, a popular game, uses Lua for game logic and modding, allowing Lua code execution on the client-side for multiplayer synchronization. However, the Lua implementation in Factorio is vulnerable to exploitation through malicious custom maps that bypass the bytecode verifier, allowing arbitrary code execution. The vulnerability, which enables attackers to create malicious bytecode and execute it on the client, is caused by the absence of an official bytecode verifier in Lua 5.2.1 and the presence of off-by-one issues in Factorio's custom implementation.