Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-12121: Lite XL can let attackers run commands

CVE-2025-12121 · published 11 months ago

Summary

Versions of Lite XL up to 2.1.8 use a function that builds shell commands without checking the input. If a malicious user can influence that input, they could cause the program to execute any command the program has permission to run. Update to a newer version or apply the provided patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
lite-xl	lite_xl	<= 2.1.8 `cpe:2.3:a:lite-xl:lite_xl::::::::`

Original advisory text

CVE-2025-12121

Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.lua), drag-and-drop file handling (rootview.lua), and the “open in system” command in the treeview plugin (treeview.lua). If an attacker could influence input to system.exec, they might execute arbitrary commands with the privileges of the Lite XL process.

References

https://kb.cert.org/vuls/id/579478 URL
https://github.com/lite-xl/lite-xl/pull/2163 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12121... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-12121 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published20 Nov 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-12121 · NVD

CVE-2025-12121 · OSV

Track software like this

Free during beta