Overview
CVE-2025-12120 identifies a critical vulnerability in Lite XL versions 2.1.8 and prior. This vulnerability stems from the application’s automatic execution of the .lite_project.lua file when a project directory is opened, without user confirmation. Since this file can contain executable Lua code, a malicious actor could craft a project containing a malicious .lite_project.lua file. When a user opens this project in Lite XL, the malicious Lua code would be executed, potentially granting the attacker arbitrary code execution privileges within the context of the Lite XL process.
Technical Details
Lite XL uses the .lite_project.lua file to store project-specific configurations. The intended functionality is to allow users to customize their development environment on a per-project basis. However, the application’s design flaw lies in its unconditional execution of this file upon project loading. The lack of any user prompt or validation mechanism before executing the Lua code introduces a significant security risk. An attacker can leverage this to execute arbitrary commands on the victim’s machine, limited only by the permissions of the Lite XL process.
The vulnerability exists because the application trusts the contents of the .lite_project.lua file without verifying its integrity or origin. This trust relationship is easily exploitable by crafting a project with a malicious configuration file.
CVSS Analysis
Due to the nature of this disclosure, a CVSS score is currently N/A. However, the potential for arbitrary code execution suggests a high severity level. Once a CVSS score is calculated, it will be updated here.
Possible Impact
The potential impact of CVE-2025-12120 is significant. Successfully exploiting this vulnerability could allow an attacker to:
- Execute arbitrary code on the victim’s machine with the privileges of the Lite XL process.
- Install malware or other malicious software.
- Access sensitive data stored on the victim’s system.
- Compromise the security of the victim’s entire system, depending on the privileges of the Lite XL process.
Mitigation and Patch Steps
The recommended mitigation is to upgrade to a version of Lite XL that addresses this vulnerability. Check the Lite XL GitHub repository for the latest releases and updates.
Until a patch is available, users can mitigate the risk by:
- Avoiding opening project directories from untrusted sources.
- Carefully reviewing the contents of any
.lite_project.luafile before opening a project. Look for suspicious code that might execute external commands or modify system settings.
References
Lite XL Pull Request #2164: Fix for Project Lua Code Execution
CERT Vulnerability Note VU#579478
