Skip to main content

VU#579478: Lite XL arbitrary code execution risks identified

Source Decision Insights Threat Desk Published November 11, 2025 Companies 2
Human View Machine View

2 companies named across 3 categories, one of 28 articles referencing GitHub. Previous coverage: VU#263614: Vulnerability in expr-eval JavaScript library can lead to remote code execution. (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Late Majority

Our classification, not the publisher's statement. Best suited for, not only for.

Overview

Lite XL is a lightweight text editor derived from the lite project, written primarily in LUA and C. It supports Windows, Linux, and macOS, and is designed for extensibility through plugins and project‑specific modules.

Description

Two vulnerabilities were identified Lite XL:

CVE-2025-12120
Lite XL versions 2.1.8 and prior automatically execute the .lite_project.LUA file when opening a project directory, without prompting the user for confirmation. The .lite_project.LUA file is intended for project-specific configuration but can contain executable LUA logic. This behavior could allow execution of untrusted LUA code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process.

CVE-2025-12121
Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.LUA), drag-and-drop file handling (rootview.LUA), and the “open in system” command in the treeview plugin (treeview.LUA). If an attacker could influence input to system.exec, they might execute arbitrary commands with the privileges of the Lite XL process.

Impact

CVE-2025-12120
When opening a project in Lite XL, the project’s LUA module was executed automatically, potentially allowing malicious code in a repository to run without user consent.

CVE-2025-12121
The legacy system.exec function allowed arbitrary shell command execution, which could be abused to compromise the host system.

Affected versions

Lite XL versions 2.1.8 and prior

Solution

Users should update to the latest version of Lite XL that includes these pull requests:

PR #1472 – Adds in a trust guard for project modules.
PR #1473 – Removed legacy exec function.

These updates ensure that untrusted projects cannot automatically execute LUA code and that unsafe system calls are no longer available.

Acknowledgements

Thanks to the reporter Dogus Demirkiran for reporting these vulnerabilities. Additional thanks to GitHub user Summertime for also identifying CVE-2025-12120 and opening Issue #1892 on GitHub. This document was written by Marisa Midler.

Vendor Information

One or more vendors are listed for this advisory. Please reference the full report for more information.

References

Other Information

Common Vulnerabilities and Exposures (CVE) Intrusion Detection System (IDS): CVE-2025-12120 CVE-2025-12121
Date Public: 2025-11-11
Date First Published: 2025-11-11
Date Last Updated: 2025-11-11 16:51 UTC
Document Revision: 1

Blog post, originally published by Marisa Midler at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/vu579478-lite-xl-arbitrary-code-execution-risks-identified/",
        "name": "VU#579478: Lite XL arbitrary code execution risks identified",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/vu579478-lite-xl-arbitrary-code-execution-risks-identified/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/microsoft/github/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/github/",
      "name": "GitHub"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Late Majority"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:51:12-06:00",
    "datePublished": "2025-11-11T12:02:56-07:00",
    "description": "Lite XL vulnerabilities allow arbitrary code execution in versions 2.1.8 and prior; users should update for enhanced security.",
    "headline": "VU#579478: Lite XL arbitrary code execution risks identified",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Marisa Midler"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/579478"
    },
    "keywords": [
      "Common Vulnerabilities and Exposures",
      "Intrusion Detection System",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/vu579478-lite-xl-arbitrary-code-execution-risks-identified/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/github/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/github/",
        "name": "GitHub"
      },
      {
        "@id": "https://decisioninsights.ai/registry/lua/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/lua/",
        "name": "Lua"
      },
      {
        "@id": "https://decisioninsights.ai/projects/lua/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/lua/",
        "name": "Lua"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages