Executive brief
Notepad Next is a cross-platform text editor based on Notepad++. A security flaw in how the application handles file extensions allows an attacker to execute malicious code on a user's computer. If a user opens a file with a specially crafted filename, the application will automatically run hidden commands, potentially leading to a full system takeover, data theft, or malware installation.
Technical details
A code injection vulnerability exists in Notepad Next's `detectLanguageFromExtension()` function within `src/NotepadNextApplication.cpp`. The application uses `QFileInfo::suffix()` to extract a file's extension and interpolates it directly into a Lua script template using `QString::arg()` without sanitization or escaping. An attacker can craft a filename containing Lua code (e.g., using decimal escape sequences to avoid character restrictions) that breaks out of the string literal and executes arbitrary commands. Because the application calls `luaL_openlibs()` unconditionally, the injected code has access to powerful libraries like `os`, `io`, and `package`. The vulnerability is triggered when a victim opens the malicious file via the GUI, command line, or drag-and-drop. This issue is patched in version 0.14.
Affected products
- dail8859 Notepad Next < 0.14
Timeline
- 2026-04-27: patched: Fix committed and version 0.14 released
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-07: disclosed: CVE-2026-42214 assigned