Lite XL Vulnerability Allows Attackers to Execute Arbitrary Code

Lite XL, a lightweight editor written in Lua and C, has been found to contain a high vulnerability that could enable arbitrary code execution, tracked as CVE-2025-12120. The flaw stems from Lite XL’s automatic execution of .lite_project.lua files when a project directory is opened, allowing specially crafted Lua code to run without user confirmation.

Affected versions are 2.1.8 and prior, and researchers warn that attackers could gain unauthorized access to system resources, exfiltrate data, or inject backdoors into ongoing projects. The security risk is heightened by the editor’s support for loading project configurations from multiple sources, which may be untrusted.

Developers mitigated the issue through two pull requests, PR #1472 introducing a trust guard and PR #1473 removing the legacy exec function, with updates now prompting user approval before code executes. Security researcher Dogus Demirkiran reported the vulnerabilities, which were independently identified by GitHub user Summertime, and the advice is to update to the patched version and be cautious when opening untrusted projects.