grub-pc-bin uses the obsolete version of minilua (single-file port of Lua) which has CVE-2014-5461 Patch attached below.