FOSS gamedev and creative worlds

If there were some way to run Lua from the server on the client's "side" (for example, the inventory stuff, even though that isn't really a client-side mod), could someone create a publicly-listed malicious server which sends to a player's client some Lua code which, when run by the player's client, deletes all of their files or something horrible like that?

If so, this would be a really good reason to never implement any "client-side modding" which causes a client to receive and run Lua code sent by the server.

No - Lua Sandboxing

When browsing the web, servers can (usually) run javascript code on your computer