Lite XL Arbitrary Code Execution Vulnerability via Project Module

A vulnerability in Lite XL text editor versions through 2.1.8 allows for arbitrary code execution. When a project directory is opened, the editor automatically executes the .lite_project.lua file without user confirmation. This file can contain executable Lua code, potentially leading to the execution of untrusted code with the same privileges as the Lite XL process. The vulnerability could be exploited by opening a malicious project.

Impact

The vulnerability could be exploited to execute arbitrary Lua code from a malicious project, with the same privileges as the Lite XL process.

Remediation

Users should update to the latest version of Lite XL that includes the trust guard for project modules. This update ensures that untrusted projects cannot automatically execute Lua code. Instructions for updating can be found on the Lite XL GitHub repository.