Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process.
References
| Link | Resource |
|---|---|
| https://github.com/lite-xl/lite-xl/pull/2164 | Issue Tracking Patch |
| https://kb.cert.org/vuls/id/579478 | Third Party Advisory Exploit Patch |
Configurations
History
10 Dec 2025, 17:47
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-94 | |
| CPE | cpe:2.3:a:lite-xl:lite_xl:*:*:*:*:*:*:*:* | |
| References | () https://github.com/lite-xl/lite-xl/pull/2164 - Issue Tracking, Patch | |
| References | () https://kb.cert.org/vuls/id/579478 - Third Party Advisory, Exploit, Patch | |
| First Time |
Lite-xl
Lite-xl lite Xl |
20 Nov 2025, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.3 |
20 Nov 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-20 17:15
Updated : 2025-12-10 17:47
NVD link : CVE-2025-12120
Mitre link : CVE-2025-12120
CVE.ORG link : CVE-2025-12120
JSON object : View
Products Affected
lite-xl
- lite_xl
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')