CVE-2026-48800 Details
Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserCommand._cmd without any validation. When the user clicks the corresponding entry in the Run menu, NppCommands.cpp:4264 creates a Command object with string2wstring(ucmd.getCmd()) and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. The injected command appears as a normal menu item in the Run menu, making it a viable persistence mechanism. This vulnerability is fixed in 8.9.6.1.
A vulnerability allowing arbitrary code execution has been identified in Notepad++ versions prior to 8.9.6.1. The issue arises from the <Command> tag content within <UserDefinedCommands> in shortcuts.xml, which is processed by the feedUserCmds() function without proper validation. When a user selects the corresponding command in the Run menu, the application executes the injected command as an executable, using ShellExecute. This flaw not only poses an immediate security risk but also allows for persistent backdoor access by injecting commands that survive reboots.
Users are advised to update to Notepad++ version 8.9.6.1 or later, where this vulnerability has been patched. For those unable to update, consider removing or disabling any user-defined commands that could exploit this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-3x3f-3j39-pj3v | CISA-ADP | ExploitPatchVendor Advisory |
| https://github.com/notepad-plus-plus/notepad-plus-plus/commit/6b3dc52a9245c6d8c6287a8d6d93a30981c05feb | [email protected] | Patch |
| https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-3x3f-3j39-pj3v | [email protected] | ExploitPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| notepad-plus-plus notepad++ | < 8.9.6.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | New CVE Received | [email protected] |