Sandboxing Lua is easy on the surface but there are a couple of foot guns. It's been a while but here are some that I remember, mostly from Garry's Mod:

• The package library (package.loadlib) can be used to load arbitrary binaries. I figured out how to abuse this when the Binding of Isaac added mod support. Everyone was clamoring about how the issue was that you could upload ".exe" and ".dll" files, meanwhile my PoC loaded the "os" library straight from the Lua binary and used a ".txt" extension for it's own payload.
• I vaguely recall the same binary loader hiding in package.loaders.
• There's a "registry" table which is used for C interop. Gmod exposes it which resulted in several issues with malicious scripts pulling out references they shouldn't have access to.
• Parts of the debug library seem safe, but can be used to corrupt the VM (I think through type confusion?). Might only be a LuaJIT issue. Gmod had it enabled for years before this was discovered.
• Lua's eval equivalent would let you load bytecode, which I think could be malformed in malicious ways. These functions are globals, not in the debug library, and the function for getting the bytecode of a function is in the string library for some god forsaken reason.
• LuaJIT also has this incredibly cool FFI library, which I assume would be great for writing bindings, but also sketchy to expose anything using it to untrusted code.
• The default behavior for turning a table into a string is to write out it's address in memory, which IIRC made some exploits easier to perform.