CVE-2025-12120: Lite-xl Lite Xl RCE Vulnerability

CVE-2025-12120 Overview

CVE-2025-12120 affects Lite XL, a lightweight text editor written in Lua and C. Versions 2.1.8 and prior automatically execute the .lite_project.lua file when a user opens a project directory. The editor performs no confirmation prompt before running this file. Because .lite_project.lua can contain arbitrary Lua logic, opening a malicious project directory results in code execution with the privileges of the Lite XL process. The issue is tracked as CWE-94: Improper Control of Generation of Code.

Critical Impact
Opening an untrusted project directory in Lite XL 2.1.8 or earlier can lead to arbitrary Lua code execution without user interaction beyond the initial open action.

Affected Products

Lite XL versions 2.1.8 and prior
The lite-xl:lite_xl component as identified in the CPE cpe:2.3:a:lite-xl:lite_xl:*:*:*:*:*:*:*:*
Any downstream distribution bundling a vulnerable Lite XL build

Discovery Timeline

2025-11-20 - CVE-2025-12120 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12120

Vulnerability Analysis

Lite XL supports per-project configuration through a .lite_project.lua file placed in the root of a project directory. When a user opens a directory, the editor loads and executes this file to apply project-specific settings. The file is a full Lua script, not a restricted configuration format, so it can invoke any function reachable from the Lite XL Lua runtime, including operating system calls exposed through the editor's API.

The vulnerability arises because Lite XL executes .lite_project.lua unconditionally on project open. No prompt, allowlist, workspace-trust mechanism, or signature check gates the execution. An attacker who convinces a target to open a repository, unzip an archive, or clone a project can achieve code execution as the current user.

Exploitation requires local access to open the project and user interaction to trigger the load, but no elevated privileges. The impact covers confidentiality, integrity, and availability, since executed Lua code inherits the full privileges of the Lite XL process.

Root Cause

The root cause is a design flaw: Lite XL treats an untrusted, repository-shipped configuration file as trusted code. This is a classic [CWE-94] code injection pattern where an external control input is fed directly to a code interpreter. Unlike similar editors that implement workspace trust, Lite XL 2.1.8 lacks any user confirmation step before evaluating project-scoped scripts.

Attack Vector

An attacker crafts a project directory containing a malicious .lite_project.lua payload and delivers it through a Git repository, archive, shared folder, or supply-chain compromise. When the victim opens the directory in Lite XL, the payload runs. Typical follow-on actions include spawning a shell, downloading a second-stage implant, exfiltrating source code, or modifying files in the workspace. The vulnerability manifests entirely in the project-load path; see the Lite XL pull request 2164 for the code path being modified and the CERT/CC advisory VU#579478 for advisory-level detail.

Detection Methods for CVE-2025-12120

Indicators of Compromise

Presence of a .lite_project.lua file in repositories or archives received from untrusted sources.
Unexpected child processes spawned by the lite-xl binary, such as shells, curl, wget, powershell, or scripting interpreters.
Outbound network connections originating from the Lite XL process to unrecognized hosts.
New files, scheduled tasks, cron entries, or persistence artifacts created in the user context shortly after opening a project.

Detection Strategies

Scan source repositories and file shares for .lite_project.lua files and review their contents for calls to os.execute, io.popen, require("process"), or filesystem writes outside the project.
Alert on process-lineage anomalies where lite-xl is the parent of interpreters or network utilities.
Correlate Lite XL process starts with subsequent file-write and network events on developer endpoints.

Monitoring Recommendations

Enable endpoint process telemetry on developer workstations and forward it to a centralized analytics platform for retrospective search.
Track installed Lite XL versions across the fleet and flag any host running 2.1.8 or earlier.
Monitor code repositories for the introduction of .lite_project.lua in pull requests and treat them as security-relevant changes.

How to Mitigate CVE-2025-12120

Immediate Actions Required

Upgrade Lite XL to a fixed release once available from the lite-xl GitHub project.
Audit developer machines for existing .lite_project.lua files and quarantine any originating from untrusted sources.
Instruct users not to open unfamiliar project directories in Lite XL until a patched build is deployed.

Patch Information

The upstream fix is tracked in Lite XL pull request #2164, which changes the project-load behavior so that .lite_project.lua is not executed without user consent. Consult the CERT/CC advisory VU#579478 for coordinated disclosure details and refer to the Lite XL release notes for the specific version containing the fix.

Workarounds

Delete any .lite_project.lua file from a project directory before opening it in Lite XL.
Inspect the contents of .lite_project.lua in a plain text viewer, not in Lite XL itself, prior to opening the parent directory.
Run Lite XL under a least-privileged user account or inside a sandbox such as firejail, bubblewrap, or a container to constrain the impact of executed Lua code.
Apply filesystem controls that block execution of Lua scripts originating from download directories.

bash

# Locate .lite_project.lua files under a workspace before opening projects
find ~/projects -type f -name '.lite_project.lua' -print

# Example sandboxed launch on Linux using firejail
firejail --net=none --private-tmp lite-xl /path/to/reviewed-project