CVE-2025-12120

{
  "id": "CVE-2025-12120",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-20T17:15:48.640",
  "lastModified": "2026-10-19T13:10:00.110",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process."
    },
    {
      "lang": "es",
      "value": "Las versiones 2.1.8 y anteriores de Lite XL ejecutan automáticamente el archivo .lite_project.lua al abrir un directorio de proyecto, sin solicitar confirmación al usuario. El archivo .lite_project.lua está destinado a la configuración específica del proyecto, pero puede contener lógica Lua ejecutable. Este comportamiento podría permitir la ejecución de código Lua no confiable si un usuario abre un proyecto malicioso, lo que podría llevar a la ejecución de código arbitrario con los privilegios del proceso de Lite XL."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Lite XL",
          "product": "Lite XL",
          "versions": [
            {
              "version": "2.1.8 and earlier",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-20T18:09:43.235043Z",
          "id": "CVE-2025-12120",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:lite-xl:lite_xl:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "2.1.8",
              "matchCriteriaId": "9F99F77B-6033-461A-95F8-0C1BEB732101"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/lite-xl/lite-xl/pull/2164",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://kb.cert.org/vuls/id/579478",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ]
    }
  ]
}