A critical vulnerability in Lite XL versions 2.1.8 and earlier allows for arbitrary code execution when a user opens a malicious project directory.

This vulnerability involves the automatic execution of the .lite_project.lua file without user confirmation, which constitutes an inclusion of functionality from an untrusted control sphere (CWE-829). An attacker can leverage this behavior to execute arbitrary Lua code with the privileges of the local user running the Lite XL process.

The ability for an attacker to achieve arbitrary code execution on a user workstation poses a significant risk to organizational data integrity and confidentiality. Given the CVSS score of 7.3, this high-severity flaw could allow a malicious actor to install persistent malware, exfiltrate sensitive source code, or pivot within the internal network. The impact is elevated because the attack requires only that a user opens a directory containing a prepared malicious file.

Immediate Action: Users should exercise extreme caution when opening unknown project directories until a patched version is released. Monitor the official Lite XL GitHub repository for updates and apply the security fix as soon as it becomes available.

Proactive Monitoring: Security teams should monitor endpoint logs for suspicious child processes spawned by the Lite XL application. Review file integrity logs for the creation or modification of .lite_project.lua files in untrusted directories.

Compensating Controls: Implement endpoint security policies that restrict the execution of scripts within untrusted project folders. Utilize EDR solutions to flag or block unusual Lua-based execution patterns originating from text editor processes.

Public Exploit Available: Unknown.

This vulnerability presents a clear risk to local system security by bypassing intended safety boundaries during project loading. Organizations should treat this as a high-priority issue, advising developers and staff to verify the contents of project directories before opening them in Lite XL. Once the vendor provides a permanent fix, deployment should be prioritized across all affected workstations to mitigate the risk of arbitrary code execution.