VDB
CVE-2025-12120
CVE-2025-12120
PUBLISHED
CVSS 7.300000190734863 HIGH
Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process.
EPSS 0.03% · 10.6th percentile
Risk Scores
CVSS 3.1
7.300000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS Score
0.03%
10.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Lite XL | Lite XL | 2.1.8 and earlier |
| lite-xl | lite_xl | 0 |
Timeline
- Oct 23, 2025 CVE ID Reserved
- Nov 11, 2025 PoC Published
- Nov 13, 2025 PoC Published
- Nov 13, 2025 PoC Published
- Nov 20, 2025 Coalition ESS Score
- Nov 20, 2025 CVE Published
- Nov 20, 2025 CVE Updated
- Nov 20, 2025 PoC Published
- Nov 21, 2025 EPSS Score
- Nov 24, 2025 Coalition ESS Score
- Nov 26, 2025 EPSS Score
- Nov 26, 2025 Coalition ESS Score