What’s Vulnerable › Vulnerabilities

CVE-2025-12120: CVE-2025-12120

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-20 · updated 2026-10-19
• Weakness: CWE-94

Description

Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process.

Affected products

• Lite XL: through 2.1.8

References

• https://github.com/lite-xl/lite-xl/pull/2164
• https://kb.cert.org/vuls/id/579478

Get alerted when CVE-2025-12120 or the next vulnerability affects your stack