Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.lua), drag-and-drop file handling (rootview.lua), and the “open in system” command in the treeview plugin (treeview.lua). If an attacker could influence input to system.exec, they might execute arbitrary commands with the privileges of the Lite XL process.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Lite XL — Arbitrary Code & Remote Code Execution (CVE-2025-12120 & CVE-2025-12121) #LiteXL #RCE #ArbitraryCode #CVEs #Security https://bend0us.github.io/vulnerabilities/lite-xl-rce/
Post summary
The message announces newly disclosed CVEs (CVE-2025-12120 & CVE-2025-12121) for Lite XL, hints at a PoC via the provided link, but does not provide exploit code or evidence of active attacks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | lite-xl | lite_xl | - | - | - |