High · published November 20, 2025
⚡ A sneaky little oversight lets untrusted Lua code run automatically! Lite XL versions 2.1.8 and earlier execute the .lite_project.lua file without so much as a "Hey, are you sure?" when you open a project! 💥 Think of it like a restaurant chef accepting any old recipe without checking the ingredients first — one bad order could spoil the whole dish! In this case, opening a project could execute harmful code without the user's knowledge. This could allow an attacker to execute arbitrary code on your system with the same privileges as the Lite XL process. Imagine a malicious recipe being followed by the chef, leading to disastrous consequences - data loss, system compromise, you name it!
Think of it like a restaurant chef accepting any old recipe without checking the ingredients first — one bad order could spoil the whole dish! In this case, opening a project could execute harmful code without the user's knowledge. This vulnerability involves the automatic execution of potentially harmful Lua code contained in the .lite_project.lua file when opening a project directory. Since there's no prompt for user confirmation, any crafted project can trigger unwanted actions with full privileges.
This could allow an attacker to execute arbitrary code on your system with the same privileges as the Lite XL process. Imagine a malicious recipe being followed by the chef, leading to disastrous consequences - data loss, system compromise, you name it! To protect yourself, upgrade to Lite XL version 2.1.9 or later immediately. Additionally, avoid opening project directories from untrusted sources and consider adding prompts for confirmation when executing scripts. 🛡️ You’ve got this! By following these steps, you’re taking a huge leap in securing your environment! 🚀
| Product | Versions | Fixed in |
|---|---|---|
| lite-xl/lite_xl | ≤ 2.1.8 | — |