Skip to content
NewA calmer, faster ZeroHour
VulnerabilityPoC4

CVE-2025-12120

CVSS 3.1
7.3 high
EPSS
<1%p26
Published
·
Modified
Analyze CVE-2025-12120 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process.

Vendors
lite-xl
Products
lite xl
Weakness
CWE-94
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news

1 story