Critical Notepad++ Flaw Could Enable Remote Code Execution Attacks

Notepad++ has released version 8.9.6.1 to address multiple security vulnerabilities, including critical flaws that could allow arbitrary code execution under specific conditions.

The update, published on May 26, 2026, patches three vulnerabilities tracked as CVE-2026-48770, CVE-2026-48778, and CVE-2026-48800. These issues affect versions up to 8.9.6 and highlight risks tied to improper handling of configuration files.

Critical Notepad++ Flaw

The most severe issue, CVE-2026-48778, stems from how Notepad++ processes the config.xml file, specifically the <GUIConfig name=”commandLineInterpreter”> parameter.

The application reads this value without validation, allowlist enforcement, or integrity checks, and later uses it when users invoke the “Open Containing Folder in cmd” feature. This behavior allows an attacker to control what executable is launched through the application.

In a typical exploitation scenario, a malicious value is injected into the configuration file, which is then executed via Windows ShellExecute when the feature is triggered.

A proof-of-concept demonstrates this by passing calc.exe as a parameter, which causes Windows Calculator to launch instead of the expected command prompt. This confirms the feasibility of arbitrary code execution through configuration manipulation.

Although the vulnerability requires user interaction, several practical attack vectors increase its risk. Attackers can directly modify the %APPDATA%\Notepad++\config.xml file under the current user context or distribute malicious shortcut files leveraging the -settingsDir parameter to point to attacker-controlled directories.

Additional scenarios include poisoning cloud-synced configuration paths supported by Notepad++ or using social engineering techniques to trick users into extracting crafted archives into AppData locations. These methods allow attackers to weaponize legitimate workflows without raising immediate suspicion.

Additional Vulnerabilities Patched

• CVE-2026-48770: A crash vulnerability triggered by malformed structures, potentially causing denial-of-service conditions
• CVE-2026-48800: An arbitrary code execution issue related to improper handling of shortcuts.xml

The primary flaw, CVE-2026-48778, is classified under CWE-78 (OS Command Injection) and carries a high severity rating due to its impact on system integrity and execution flow.

Despite requiring user interaction, the low attack complexity and absence of privilege requirements make it a significant security concern in real-world environments.

Users and organizations are strongly advised to upgrade to Notepad++ version 8.9.6.1 immediately. Applying the patch mitigates the risk by improving configuration handling.

Additional defensive measures include monitoring changes to configuration files, restricting write permissions to sensitive directories, and, where possible, validating executable paths.

This incident highlights the broader security risks associated with unvalidated configuration inputs in widely deployed applications. Ensuring proper input validation and restricting execution paths remain critical steps in reducing exposure to similar threats.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.