grub-pc uses the obsolete version of minilua (single-file port of Lua) which has CVE-2014-5461 Patch attached below.