CVE-2026-48778

Published Jun 26, 2026

Last updated 14 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-48778 is a vulnerability identified in Notepad++, a popular open-source text editor for Windows. This flaw resides in how the application processes its `config.xml` configuration file, specifically within the `<GUIConfig name="commandLineInterpreter">` tag. The value from this tag is read and stored without any validation or digital signature checks. When a user initiates the "File → Open Containing Folder → cmd" action, Notepad++ passes the unvalidated string from the `commandLineInterpreter` tag directly to the `ShellExecute()` function. This allows an attacker to substitute an arbitrary executable in place of the intended command interpreter, leading to arbitrary code execution. Potential exploitation vectors include direct modification of the `config.xml` file, use of malicious shortcuts with the `-settingsDir=` flag, or cloud sync poisoning. The vulnerability was addressed in Notepad++ version 8.9.6.1.

Description: Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 creates a Command object with this value and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. This vulnerability is fixed in 8.9.6.1.
Source: security-advisories@github.com
NVD status: Analyzed
Products: notepad\+\+

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:notepad-plus-plus:notepad\\+\\+:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E0D0325F-713A-4523-8DE8-51517017DC16",
            "versionEndExcluding": "8.9.6.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.