CVE-2025-12120 - Vulnerability Details - OpenCVE

Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/lite-xl/lite-xl/pull/2164
https://kb.cert.org/vuls/id/579478

History

Thu, 20 Nov 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 20 Nov 2025 16:45:00 +0000

Type	Values Removed	Values Added
Description		Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process.
Title		CVE-2025-12120
References		https://github.com/lite-xl/lite-xl/pull/2164 https://kb.cert.org/vuls/id/579478

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2025-11-20T16:38:29.108Z

Updated: 2025-11-20T18:09:45.449Z

Reserved: 2025-10-23T18:11:16.473Z

Link: CVE-2025-12120

Vulnrichment

Updated: 2025-11-20T18:09:32.727Z

NVD

Status : Awaiting Analysis

Published: 2025-11-20T17:15:48.640

Modified: 2025-11-21T15:13:13.800

Link: CVE-2025-12120

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12120", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2025-10-23T18:11:16.473Z", "datePublished": "2025-11-20T16:38:29.108Z", "dateUpdated": "2025-11-20T18:09:45.449Z"}, "containers": {"cna": {"title": "CVE-2025-12120", "descriptions": [{"lang": "en", "value": "Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Lite XL", "product": "Lite XL", "versions": [{"status": "affected", "version": "2.1.8 and earlier"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"}]}], "references": [{"url": "https://github.com/lite-xl/lite-xl/pull/2164"}, {"url": "https://kb.cert.org/vuls/id/579478"}], "x_generator": {"engine": "VINCE 3.0.29", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-12120"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2025-11-20T16:52:31.931Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-20T18:09:43.235043Z", "id": "CVE-2025-12120", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-20T18:09:45.449Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-12120", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-20T18:09:43.235043Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-20T18:09:32.727Z"}}], "cna": {"title": "CVE-2025-12120", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Lite XL", "product": "Lite XL", "versions": [{"status": "affected", "version": "2.1.8 and earlier"}]}], "references": [{"url": "https://github.com/lite-xl/lite-xl/pull/2164"}, {"url": "https://kb.cert.org/vuls/id/579478"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.29", "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-12120"}, "descriptions": [{"lang": "en", "value": "Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2025-11-20T16:52:31.931Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12120", "state": "PUBLISHED", "dateUpdated": "2025-11-20T18:09:45.449Z", "dateReserved": "2025-10-23T18:11:16.473Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2025-11-20T16:38:29.108Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}