CVE-2025-12121

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12121", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2025-10-23T18:11:28.957Z", "datePublished": "2025-11-20T16:39:05.297Z", "dateUpdated": "2025-11-20T18:10:14.597Z"}, "containers": {"cna": {"title": "CVE-2025-12121", "descriptions": [{"lang": "en", "value": "Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.lua), drag-and-drop file handling (rootview.lua), and the \u201copen in system\u201d command in the treeview plugin (treeview.lua). If an attacker could influence input to system.exec, they might execute arbitrary commands with the privileges of the Lite XL process."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Lite XL", "product": "Lite XL", "versions": [{"status": "affected", "version": "2.1.8 and earlier"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "references": [{"url": "https://github.com/lite-xl/lite-xl/pull/2163"}, {"url": "https://kb.cert.org/vuls/id/579478"}], "x_generator": {"engine": "VINCE 3.0.29", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-12121"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2025-11-20T17:05:35.524Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-20T18:09:54.009033Z", "id": "CVE-2025-12121", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-20T18:10:14.597Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-12121", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-20T18:09:54.009033Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-20T18:10:06.808Z"}}], "cna": {"title": "CVE-2025-12121", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Lite XL", "product": "Lite XL", "versions": [{"status": "affected", "version": "2.1.8 and earlier"}]}], "references": [{"url": "https://github.com/lite-xl/lite-xl/pull/2163"}, {"url": "https://kb.cert.org/vuls/id/579478"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.29", "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-12121"}, "descriptions": [{"lang": "en", "value": "Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.lua), drag-and-drop file handling (rootview.lua), and the \u201copen in system\u201d command in the treeview plugin (treeview.lua). If an attacker could influence input to system.exec, they might execute arbitrary commands with the privileges of the Lite XL process."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2025-11-20T17:05:35.524Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12121", "state": "PUBLISHED", "dateUpdated": "2025-11-20T18:10:14.597Z", "dateReserved": "2025-10-23T18:11:28.957Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2025-11-20T16:39:05.297Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Lite XL", "vendor": "Lite XL", "versions": [{"status": "affected", "version": "2.1.8 and earlier"}]}], "source": "cret@cert.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lite-xl:lite_xl:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F99F77B-6033-461A-95F8-0C1BEB732101", "versionEndIncluding": "2.1.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.lua), drag-and-drop file handling (rootview.lua), and the \u201copen in system\u201d command in the treeview plugin (treeview.lua). If an attacker could influence input to system.exec, they might execute arbitrary commands with the privileges of the Lite XL process."}, {"lang": "es", "value": "Las versiones 2.1.8 y anteriores de Lite XL contienen una vulnerabilidad en la funci\u00f3n system.exec, que permit\u00eda la ejecuci\u00f3n arbitraria de comandos a trav\u00e9s de la construcci\u00f3n de comandos de shell no saneados. Esta funci\u00f3n se utilizaba en el lanzamiento de directorios de proyectos (core.lua), el manejo de archivos de arrastrar y soltar (rootview.lua) y el comando \u201cabrir en el sistema\u201d en el plugin treeview (treeview.lua). Si un atacante pudiera influir en la entrada a system.exec, podr\u00eda ejecutar comandos arbitrarios con los privilegios del proceso Lite XL."}], "id": "CVE-2025-12121", "lastModified": "2026-10-19T13:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12121", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-20T18:09:54.009033Z", "version": "2.0.3"}}]}, "published": "2025-11-20T17:15:48.787", "references": [{"source": "cret@cert.org", "tags": ["Patch"], "url": "https://github.com/lite-xl/lite-xl/pull/2163"}, {"source": "cret@cert.org", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://kb.cert.org/vuls/id/579478"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2025-11-24T09:09:47.485966+00:00", "updated": "2025-11-24T09:09:47.485992+00:00", "vendors": ["lite_xl", "lite_xl$PRODUCT$lite_xl"]}