Lite XL Arbitrary Command Execution Vulnerability

A vulnerability allowing arbitrary command execution has been identified in Lite XL versions through 2.1.8. This issue arises from the system.exec function, which constructed shell commands unsafely, enabling execution of commands with the privileges of the Lite XL process. The vulnerability was present in project directory launching, drag-and-drop file handling, and the 'open in system' command of the treeview plugin.

Impact

Exploitation of this vulnerability allowed for arbitrary shell command execution, which could be used to compromise the host system.

Remediation

Users are advised to update to the latest version of Lite XL that includes the removal of the legacy exec function. This update ensures that unsafe system calls are no longer available.