Lite XL Text Editor Vulnerability Allows Remote Code Execution

A new vulnerability has been discovered in Lite XL, a lightweight open-source text editor, that could let attackers run arbitrary code on affected systems.

Researchers from Carnegie Mellon University identified this flaw as CVE-2025-12120, affecting Lite XL versions 2.1.8 and earlier. The issue lies in how the editor handles project configuration files.

How the Vulnerability Works

When a user opens a project folder, Lite XL automatically runs the .lite_project.lua file inside that directory — without asking for any confirmation.

This file is designed to store project-specific settings, but it can also contain executable Lua code. Because there’s no verification step before execution, an attacker can embed malicious Lua code inside this file.

If a user opens a malicious project directory, the code executes instantly with the same privileges as the Lite XL application.

Impact and Risk

Attackers can share infected project folders through GitHub, file-sharing services, or other developer platforms. Once opened in Lite XL, the malicious file runs silently, allowing attackers to:

• Steal sensitive data
• Modify or delete files
• Install malware
• Further compromise the system

This makes the vulnerability especially dangerous, as many developers trust files from familiar sources or repositories without closely checking them.

The level of impact depends on the user’s permissions — if Lite XL runs with elevated privileges, the attacker gains the same access.

Affected Versions

How to Stay Safe

• Update Lite XL to the latest version as soon as a patch becomes available.
• Avoid opening untrusted project directories in Lite XL.
• Check the .lite_project.lua file for suspicious code before using projects from unknown or public sources.
• Developers recommend that Lite XL should include a confirmation prompt before running project files or disable automatic execution completely.

This vulnerability highlights the importance of understanding how configuration files work — especially when they can execute code.