CVE-2026-48778 Details
Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 creates a Command object with this value and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. This vulnerability is fixed in 8.9.6.1.
A vulnerability allowing arbitrary code execution has been identified in Notepad++ versions prior to 8.9.6.1. The issue arises because the '<GUIConfig name="commandLineInterpreter">' tag in config.xml is read without any validation or security checks. This unvalidated input is then used as the executable path when the user selects 'Open Containing Folder' from the file menu, triggering the execution of the specified command. Several methods could be used to exploit this vulnerability, including direct modification of the config.xml file, using a malicious shortcut, cloud sync poisoning, or social engineering to extract an archive containing the payload.
Users are advised to update to Notepad++ version 8.9.6.1 or later, where this vulnerability has been patched. The update removes the 'commandLineInterpreter' configuration and replaces the 'Open Containing Folder' command with an option to open the folder in PowerShell, using a trusted system path.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9 | CISA-ADP | ExploitPatchVendor Advisory |
| https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614 | [email protected] | Patch |
| https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9 | [email protected] | ExploitPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| notepad-plus-plus notepad++ | < 8.9.6.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |