CVE-2025-12120

Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/lite-xl/lite-xl/pull/2164	Issue Tracking Patch
https://kb.cert.org/vuls/id/579478	Exploit Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lite-xl:lite_xl:*:*:*:*:*:*:*:*

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Las versiones 2.1.8 y anteriores de Lite XL ejecutan automáticamente el archivo .lite_project.lua al abrir un directorio de proyecto, sin solicitar confirmación al usuario. El archivo .lite_project.lua está destinado a la configuración específica del proyecto, pero puede contener lógica Lua ejecutable. Este comportamiento podría permitir la ejecución de código Lua no confiable si un usuario abre un proyecto malicioso, lo que podría llevar a la ejecución de código arbitrario con los privilegios del proceso de Lite XL.

Information

Published : 2025-11-20 17:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-12120

Mitre link : CVE-2025-12120

CVE.ORG link : CVE-2025-12120

JSON object : View

Products Affected

lite-xl

lite_xl

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-12120", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12120", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-20T18:09:43.235043Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Lite XL", "product": "Lite XL", "versions": [{"status": "affected", "version": "2.1.8 and earlier"}]}]}], "published": "2025-11-20T17:15:48.640", "references": [{"url": "https://github.com/lite-xl/lite-xl/pull/2164", "tags": ["Issue Tracking", "Patch"], "source": "cret@cert.org"}, {"url": "https://kb.cert.org/vuls/id/579478", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process."}, {"lang": "es", "value": "Las versiones 2.1.8 y anteriores de Lite XL ejecutan autom\u00e1ticamente el archivo .lite_project.lua al abrir un directorio de proyecto, sin solicitar confirmaci\u00f3n al usuario. El archivo .lite_project.lua est\u00e1 destinado a la configuraci\u00f3n espec\u00edfica del proyecto, pero puede contener l\u00f3gica Lua ejecutable. Este comportamiento podr\u00eda permitir la ejecuci\u00f3n de c\u00f3digo Lua no confiable si un usuario abre un proyecto malicioso, lo que podr\u00eda llevar a la ejecuci\u00f3n de c\u00f3digo arbitrario con los privilegios del proceso de Lite XL."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lite-xl:lite_xl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F99F77B-6033-461A-95F8-0C1BEB732101", "versionEndIncluding": "2.1.8"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}