High 7.3Published Nov 20, 2025

CVE-2025-12120CVE-2025-12120

Updated under an hour ago (Oct 28, 2026, 2:23 AM ET)

Does this affect you?

It affects Lite XL and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Lite XL

Exploited in the last 30 days

Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process.

CVSS: 7.3 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-829
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: certcc
NVD analysis: Analyzed
Record last updated: Nov 20, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Lite XL Lite XL lite_xl:lite_xl (from the name)	2.1.8 and earlier	CNA record
lite-xl lite_xl lite-xl:lite_xl	through 2.1.8	NVD

References

References

https://github.com/lite-xl/lite-xl/pull/2164	issue-tracking, patch
https://kb.cert.org/vuls/id/579478	exploit, patch, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.