CVE-2026-42214 Details
Description
Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14.
A vulnerability allowing arbitrary code execution has been identified in Notepad Next, a cross-platform reimplementation of Notepad++. This issue affects versions prior to 0.14. The vulnerability arises in the 'detectLanguageFromExtension()' function, which improperly interpolates file extensions into a Lua script without any sanitization. An attacker can exploit this by crafting a filename with a malicious extension that includes Lua code. When the file is opened in Notepad Next, the injected code executes automatically. The exploitation is facilitated by the unconditional invocation of 'luaL_openlibs()', which grants the injected code access to the full 'os', 'io', and 'package' libraries, enabling arbitrary command execution.
Users can update to Notepad Next version 0.14 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc | [email protected] | Patch |
| https://github.com/dail8859/NotepadNext/releases/tag/v0.14 | [email protected] | Release Notes |
| https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dail8859 notepad next | < 0.14 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | Initial Analysis | [email protected] |
| May 7, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |