Critical Notepad++ Flaws Let Attackers Run Code

Key Takeaways

• A critical security update for Notepad++ addresses three significant vulnerabilities, including two allowing arbitrary code execution.
• The flaws could enable attackers to remotely run malicious programs on affected Windows systems.
• Versions v8.9.6 and earlier of the popular text editor are impacted.
• Users are strongly advised to update to Notepad++ v8.9.6.1 immediately to patch these issues.

A recent security bulletin highlights urgent fixes for three vulnerabilities in Notepad++, the widely adopted open-source text editor for Windows. Among these, two critical flaws could permit attackers to execute arbitrary code, potentially leading to the silent deployment of malicious software on a victim’s machine.

The Notepad++ development team moved swiftly, releasing version v8.9.6.1 on May 26, 2026, which incorporates patches for all identified security weaknesses. Users operating any version prior to v8.9.6.1 are strongly urged to update their installations without delay.

Notepad++ Vulnerabilities

The update specifically addresses the following vulnerabilities:

Arbitrary Code Execution via config.xml (CVE-2026-48778)

The most severe of the discovered vulnerabilities, CVE-2026-48778, exploits a weakness within Notepad++’s config.xml file. Specifically, the vulnerability targets the <GUIConfig name="commandLineInterpreter"> tag.

During operation, the text editor retrieves the value from this tag via the NppXml::value() function located in Parameters.cpp. Critically, this value is stored without any form of validation, whitelisting, or digital signature verification. This oversight creates a pathway for malicious manipulation.

When a user initiates the “File → Open Containing Folder → cmd” action, the application constructs a command object using the attacker-controlled string. This object is then directly passed to the ShellExecute() function, resulting in the execution of whatever payload the attacker has embedded.

Proof-of-concept testing confirmed this capability, demonstrating that by injecting calc.exe into the XML tag, the Windows Calculator application would launch instead of the expected command prompt, thereby confirming full arbitrary code execution.

Researchers have identified several practical methods an attacker could leverage to exploit CVE-2026-48778, as detailed in the security advisory:

• Direct Configuration File Modification: Any process operating under the same user account as Notepad++ can alter the %APPDATA%Notepad++config.xml file.
• Malicious Shortcut Exploitation: Attackers could craft a malicious shortcut (.lnk) file that utilizes the -settingsDir= flag to redirect Notepad++ to a directory controlled by the attacker.
• Cloud Sync Poisoning: Given Notepad++’s support for user-defined cloud paths, an attacker could compromise cloud storage and inject a malicious configuration.
• Social Engineering via Archive Extraction: Users could be tricked into extracting archives containing a tampered configuration file into their AppData directory.

Arbitrary Code Execution via shortcuts.xml (CVE-2026-48800)

CVE-2026-48800 presents a similar arbitrary code execution risk, but its vector targets the shortcuts.xml file within Notepad++.

What You Should Do

• Update Immediately: All Notepad++ users running versions v8.9.6 or earlier should update to v8.9.6.1 without delay. The update is available on the official Notepad++ releases page.
• Review Configuration Management: Enterprise environments should pay particular attention to how Notepad++ configurations are managed, especially in setups involving shared or cloud-synced directories.
• Implement Whitelisting (Vendor Recommendation): While not yet implemented, security researchers recommend that Notepad++ adopt a whitelist for permitted command-line interpreters (e.g., cmd.exe, powershell.exe) and validate executable paths against known system directories.
• Consider User Confirmation: The suggestion for Notepad++ to introduce a user confirmation dialog before executing any shell command is a valuable security enhancement that users should be aware of.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.