Arbitrary Code Execution in Lite XL by Lite XL

CVE-2025-12120

What is CVE-2025-12120?

Lite XL versions 2.1.8 and earlier have a vulnerability that automatically executes the .lite_project.lua file upon opening a project directory, without requiring user confirmation. This file, designed for project configuration, can include executable Lua scripts. If a user unknowingly opens a compromised project, it could lead to the execution of untrusted Lua code with the same privileges as the Lite XL process, potentially allowing attackers to execute arbitrary commands on the system.

References