CERT/CC Warns of Code Execution Flaws in Lite XL Text Editor (CVE-2025-12120, CVE-2025-12121)

CERT/CC has warned of two severe flaws in Lite XL that could allow remote code execution, tracked as CVE-2025-12120 and CVE-2025-12121. The first flaw stems from Lite XL’s automatic execution of .lite_project.lua files when a user opens a project directory, which can contain arbitrary Lua code and enable attackers to run code with the editor’s privileges.

The second vulnerability involves improper sanitisation in the system[.]exec function, used across multiple components including core.lua, rootview.lua, and the treeview plugin, potentially allowing arbitrary shell command execution with the same privileges as the editor process. Both weaknesses could be exploited simply by opening a malicious project or via unsafe handling of commands in plugins and scripting interfaces, creating critical remote code execution paths.

The vulnerabilities affect Lite XL versions 2.1.8 and earlier, and the maintainers have urged users to upgrade to the latest release that includes fixes from GitHub pull requests #1472 and #1473, as credited by CERT/CC and the Lite XL team. Dogus Demirkiran was credited by both the Lite XL maintainers and CERT/CC for identifying and reporting the issues.