Executive brief
Notepad++ is a popular open-source text and code editor. A security flaw allows an attacker to execute malicious code on a user's computer by modifying the application's configuration file. If a user is tricked into using a compromised configuration and then selects the 'Open Containing Folder in cmd' option, the attacker's code will run with the user's full permissions, potentially leading to a complete system takeover.
Technical details
A command injection vulnerability exists in Notepad++ versions prior to 8.9.6.1 due to improper validation of the 'commandLineInterpreter' tag within the config.xml file. The application reads this value and passes it directly to ShellExecute when a user selects 'File -> Open Containing Folder -> cmd'. An attacker can exploit this by modifying the configuration file via local access, malicious shortcuts, or cloud synchronization poisoning. Successful exploitation requires the user to manually trigger the specific 'cmd' menu action, resulting in arbitrary code execution with the privileges of the Notepad++ process. The issue was resolved in version 8.9.6.1 by removing the configurable interpreter tag and using hardcoded, trusted system paths.
Affected products
- Notepad++ Notepad++ < 8.9.6.1
Timeline
- 2026-05-25: patched: Fix committed to repository
- 2026-05-26: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: CVE published to NVD