CVE-2025-12120

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12120", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2025-10-23T18:11:16.473Z", "datePublished": "2025-11-20T16:38:29.108Z", "dateUpdated": "2025-11-20T18:09:45.449Z"}, "containers": {"cna": {"title": "CVE-2025-12120", "descriptions": [{"lang": "en", "value": "Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Lite XL", "product": "Lite XL", "versions": [{"status": "affected", "version": "2.1.8 and earlier"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"}]}], "references": [{"url": "https://github.com/lite-xl/lite-xl/pull/2164"}, {"url": "https://kb.cert.org/vuls/id/579478"}], "x_generator": {"engine": "VINCE 3.0.29", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-12120"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2025-11-20T16:52:31.931Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-20T18:09:43.235043Z", "id": "CVE-2025-12120", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-20T18:09:45.449Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-12120", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-20T18:09:43.235043Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-20T18:09:32.727Z"}}], "cna": {"title": "CVE-2025-12120", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Lite XL", "product": "Lite XL", "versions": [{"status": "affected", "version": "2.1.8 and earlier"}]}], "references": [{"url": "https://github.com/lite-xl/lite-xl/pull/2164"}, {"url": "https://kb.cert.org/vuls/id/579478"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.29", "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-12120"}, "descriptions": [{"lang": "en", "value": "Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2025-11-20T16:52:31.931Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12120", "state": "PUBLISHED", "dateUpdated": "2025-11-20T18:09:45.449Z", "dateReserved": "2025-10-23T18:11:16.473Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2025-11-20T16:38:29.108Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Lite XL", "vendor": "Lite XL", "versions": [{"status": "affected", "version": "2.1.8 and earlier"}]}], "source": "cret@cert.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lite-xl:lite_xl:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F99F77B-6033-461A-95F8-0C1BEB732101", "versionEndIncluding": "2.1.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process."}, {"lang": "es", "value": "Las versiones 2.1.8 y anteriores de Lite XL ejecutan autom\u00e1ticamente el archivo .lite_project.lua al abrir un directorio de proyecto, sin solicitar confirmaci\u00f3n al usuario. El archivo .lite_project.lua est\u00e1 destinado a la configuraci\u00f3n espec\u00edfica del proyecto, pero puede contener l\u00f3gica Lua ejecutable. Este comportamiento podr\u00eda permitir la ejecuci\u00f3n de c\u00f3digo Lua no confiable si un usuario abre un proyecto malicioso, lo que podr\u00eda llevar a la ejecuci\u00f3n de c\u00f3digo arbitrario con los privilegios del proceso de Lite XL."}], "id": "CVE-2025-12120", "lastModified": "2026-10-19T13:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12120", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-20T18:09:43.235043Z", "version": "2.0.3"}}]}, "published": "2025-11-20T17:15:48.640", "references": [{"source": "cret@cert.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/lite-xl/lite-xl/pull/2164"}, {"source": "cret@cert.org", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://kb.cert.org/vuls/id/579478"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2025-11-24T09:09:48.553834+00:00", "updated": "2025-11-24T09:09:48.553859+00:00", "vendors": ["lite_xl", "lite_xl$PRODUCT$lite_xl"]}