CVE-2025-12121
BaseFortify
Publication date: 2025-11-20
Last updated on: 2025-12-10
Assigner: CERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lite-xl | lite_xl | to 2.1.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Lite XL versions 2.1.8 and earlier, specifically in the system.exec function. It allows an attacker to execute arbitrary commands on the system because the function constructs shell commands without properly sanitizing input. This affects features like project directory launching, drag-and-drop file handling, and the 'open in system' command in the treeview plugin. If an attacker can control the input to system.exec, they can run commands with the same privileges as the Lite XL process.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to execute arbitrary commands on your system with the privileges of the Lite XL process. This could lead to unauthorized actions such as modifying files, installing malware, or gaining further access to your system, depending on the permissions of the Lite XL application.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update Lite XL to a version later than 2.1.8 where the system.exec function vulnerability is fixed. Avoid using or exposing features that rely on system.exec with untrusted input, such as project directory launching, drag-and-drop file handling, and the "open in system" command in the treeview plugin until the update is applied.