CVE-2025-12120 — CVE-2025-12120

Description (CNA)

Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process.

Affected (CNA)

Vendor / product	Versions
Lite XL / Lite XL	affected 2.1.8 and earlier

CWE

No CWE identifiers supplied.

References

https://github.com/lite-xl/lite-xl/pull/2164
https://kb.cert.org/vuls/id/579478

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.