Here are two slide decks talking (roughly) about real-world attacks against Lua 5.1 and 5.2's bytecode: 5.1: https://www.lua.org/wshop11/Cawley.pdf https://www

Here are two slide decks talking (roughly) about real-world attacks against Lua 5.1 and 5.2's bytecode: 5.1: https://www.lua.org/wshop11/Cawley.pdf https://www.lua.org/wshop11/Cawley.pdf 5.2: https://apocrypha.numin.it/talks/lua_bytecode_exploitation.pdf https://apocrypha.numin.it/talks/lua_bytecode_exploitation.p... Lua used to have a built-in bytecode verifier as I understand it, but it never reached the point to where it was enough to safeguard the VM.