A critical OS Command Injection vulnerability in Lite XL versions 2.1.8 and earlier allows local attackers to execute arbitrary code with the privileges of the application process.

The application fails to properly sanitize input used in the system.exec function, which is utilized in core modules such as project directory launching, drag-and-drop handling, and the treeview plugin. An attacker with local access can leverage this flaw to execute arbitrary commands, requiring the user to perform an action like dragging a file or opening a specific directory.

The vulnerability carries a CVSS score of 7.3, indicating a high level of risk for local environments. Successful exploitation allows an attacker to gain the same execution privileges as the Lite XL process, potentially leading to full system compromise, unauthorized data access, or the installation of persistent malicious software on the host machine.

Immediate Action: Review the official Lite XL GitHub repository and apply the latest security patches or updates provided by the maintainers to resolve the command injection flaw.

Proactive Monitoring: Monitor system logs for unusual process spawning or unexpected command-line activity originating from the Lite XL executable.

Compensating Controls: Restrict permissions on the host system to ensure that the Lite XL application runs with the least privilege necessary, thereby limiting the potential damage if an injection occurs.

Public Exploit Available: Unknown

Given the potential for total impact on the affected system, users should prioritize updating their Lite XL installation to a version beyond 2.1.8 as soon as a fix is confirmed available. Organizations running this software in multi-user environments should treat this as a high-priority item to prevent local privilege escalation and potential lateral movement.