CVE-2025-12121

{
  "id": "CVE-2025-12121",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-20T17:15:48.787",
  "lastModified": "2026-10-19T13:10:00.110",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.lua), drag-and-drop file handling (rootview.lua), and the “open in system” command in the treeview plugin (treeview.lua). If an attacker could influence input to system.exec, they might execute arbitrary commands with the privileges of the Lite XL process."
    },
    {
      "lang": "es",
      "value": "Las versiones 2.1.8 y anteriores de Lite XL contienen una vulnerabilidad en la función system.exec, que permitía la ejecución arbitraria de comandos a través de la construcción de comandos de shell no saneados. Esta función se utilizaba en el lanzamiento de directorios de proyectos (core.lua), el manejo de archivos de arrastrar y soltar (rootview.lua) y el comando “abrir en el sistema” en el plugin treeview (treeview.lua). Si un atacante pudiera influir en la entrada a system.exec, podría ejecutar comandos arbitrarios con los privilegios del proceso Lite XL."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Lite XL",
          "product": "Lite XL",
          "versions": [
            {
              "version": "2.1.8 and earlier",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-20T18:09:54.009033Z",
          "id": "CVE-2025-12121",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:lite-xl:lite_xl:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "2.1.8",
              "matchCriteriaId": "9F99F77B-6033-461A-95F8-0C1BEB732101"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/lite-xl/lite-xl/pull/2163",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://kb.cert.org/vuls/id/579478",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ]
    }
  ]
}