BaseFortify

Publication date: 2025-11-20

Last updated on: 2025-12-10

Assigner: CERT/CC

Description

Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.lua), drag-and-drop file handling (rootview.lua), and the “open in system” command in the treeview plugin (treeview.lua). If an attacker could influence input to system.exec, they might execute arbitrary commands with the privileges of the Lite XL process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-20

Last Modified

2025-12-10

Generated

2026-07-06

AI Q&A

2025-11-20

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12121

Affected Vendors & Products

Vendor	Product	Version / Range
lite-xl	lite_xl	to 2.1.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Lite XL versions 2.1.8 and earlier, specifically in the system.exec function. It allows an attacker to execute arbitrary commands on the system because the function constructs shell commands without properly sanitizing input. This affects features like project directory launching, drag-and-drop file handling, and the 'open in system' command in the treeview plugin. If an attacker can control the input to system.exec, they can run commands with the same privileges as the Lite XL process.

Impact Analysis

If exploited, this vulnerability can allow an attacker to execute arbitrary commands on your system with the privileges of the Lite XL process. This could lead to unauthorized actions such as modifying files, installing malware, or gaining further access to your system, depending on the permissions of the Lite XL application.

Mitigation Strategies

To mitigate this vulnerability, immediately update Lite XL to a version later than 2.1.8 where the system.exec function vulnerability is fixed. Avoid using or exposing features that rely on system.exec with untrusted input, such as project directory launching, drag-and-drop file handling, and the "open in system" command in the treeview plugin until the update is applied.

Hi! I’m here to help you understand CVE-2025-12121. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70