CyberSecBulletin

Lite XL vulnerabilities

We track 2 vulnerabilities in Lite XL products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 20, 2025.

2vulnerabilities
0critical
2high
0exploited
7.3average CVSS score

Latest Lite XL vulnerabilities

  • 7.3 High severity

    Lite XL: Improper Neutralization of Special Elements used in an OS Command

    CVE-2025-12121Lite XL

    Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.lua), drag-and-drop file

  • 7.3 High severity

    Lite XL: Improper Control of Generation of Code

    CVE-2025-12120Lite XL

    Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executabl