CVE-2026-48800

Published Jun 26, 2026

Last updated 14 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-48800 is an OS Command Injection vulnerability found in Notepad++, a popular text editor for Windows. This flaw specifically affects the `UserDefinedCommands` component within the `shortcuts.xml` file. The vulnerability arises from insufficient input validation of the `<Command>` tag, which is subsequently passed directly to the `ShellExecute` function as an executable path. Exploitation of CVE-2026-48800 could allow an attacker with local access to execute arbitrary code on the affected system. This vulnerability was addressed by the Notepad++ development team in version 8.9.6.1, released on May 26, 2026, as part of a patch for a trio of security issues.

Description: Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserCommand._cmd without any validation. When the user clicks the corresponding entry in the Run menu, NppCommands.cpp:4264 creates a Command object with string2wstring(ucmd.getCmd()) and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. The injected command appears as a normal menu item in the Run menu, making it a viable persistence mechanism. This vulnerability is fixed in 8.9.6.1.
Source: security-advisories@github.com
NVD status: Modified
Products: notepad\+\+

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:notepad-plus-plus:notepad\\+\\+:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E0D0325F-713A-4523-8DE8-51517017DC16",
            "versionEndExcluding": "8.9.6.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.