This bug was reported against the Debian package, but is an upstream issue :

Saved game files are composed of Lua scripts that recover a game's state. A file can be modified to put any Lua code inside, leading to arbitrary code execution while loading.

"A file can be modified to put any Lua code inside, leading to arbitrary code execution while loading."

That's true. But it is also true with the data files. They also contain Lua scripts... What's the real threat here ????

relates to issue953

I guess it Depends on what capabilities 
this lua code haves. It is not harmful 
unless it can access system I/O or break 
the "sandbox".

Fixed in commit e106cec2c
Lua sandboxing added