CVE-2025-12121

Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.lua), drag-and-drop file handling (rootview.lua), and the “open in system” command in the treeview plugin (treeview.lua). If an attacker could influence input to system.exec, they might execute arbitrary commands with the privileges of the Lite XL process.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/lite-xl/lite-xl/pull/2163	Patch
https://kb.cert.org/vuls/id/579478	Exploit Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lite-xl:lite_xl:*:*:*:*:*:*:*:*

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Las versiones 2.1.8 y anteriores de Lite XL contienen una vulnerabilidad en la función system.exec, que permitía la ejecución arbitraria de comandos a través de la construcción de comandos de shell no saneados. Esta función se utilizaba en el lanzamiento de directorios de proyectos (core.lua), el manejo de archivos de arrastrar y soltar (rootview.lua) y el comando “abrir en el sistema” en el plugin treeview (treeview.lua). Si un atacante pudiera influir en la entrada a system.exec, podría ejecutar comandos arbitrarios con los privilegios del proceso Lite XL.

Information

Published : 2025-11-20 17:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-12121

Mitre link : CVE-2025-12121

CVE.ORG link : CVE-2025-12121

JSON object : View

Products Affected

lite-xl

lite_xl

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-12121", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12121", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-20T18:09:54.009033Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Lite XL", "product": "Lite XL", "versions": [{"status": "affected", "version": "2.1.8 and earlier"}]}]}], "published": "2025-11-20T17:15:48.787", "references": [{"url": "https://github.com/lite-xl/lite-xl/pull/2163", "tags": ["Patch"], "source": "cret@cert.org"}, {"url": "https://kb.cert.org/vuls/id/579478", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.lua), drag-and-drop file handling (rootview.lua), and the \u201copen in system\u201d command in the treeview plugin (treeview.lua). If an attacker could influence input to system.exec, they might execute arbitrary commands with the privileges of the Lite XL process."}, {"lang": "es", "value": "Las versiones 2.1.8 y anteriores de Lite XL contienen una vulnerabilidad en la funci\u00f3n system.exec, que permit\u00eda la ejecuci\u00f3n arbitraria de comandos a trav\u00e9s de la construcci\u00f3n de comandos de shell no saneados. Esta funci\u00f3n se utilizaba en el lanzamiento de directorios de proyectos (core.lua), el manejo de archivos de arrastrar y soltar (rootview.lua) y el comando \u201cabrir en el sistema\u201d en el plugin treeview (treeview.lua). Si un atacante pudiera influir en la entrada a system.exec, podr\u00eda ejecutar comandos arbitrarios con los privilegios del proceso Lite XL."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lite-xl:lite_xl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F99F77B-6033-461A-95F8-0C1BEB732101", "versionEndIncluding": "2.1.8"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}