Executive brief
Notepad++ is a popular open-source text and code editor. A vulnerability in how the application handles user-defined commands allows an attacker to inject malicious commands into the program's 'Run' menu by modifying a configuration file. If a user is tricked into clicking the malicious menu item, the attacker can execute arbitrary code on the system, potentially leading to full system compromise or persistent access.
Technical details
An OS command injection vulnerability exists in Notepad++ prior to version 8.9.6.1. The application reads the <Command> tag within <UserDefinedCommands> from the shortcuts.xml file using NppXml::value() and stores it in UserCommand._cmd without validation. When a user selects the corresponding entry in the 'Run' menu, the application calls ShellExecute with the attacker-controlled string. Attackers can exploit this by directly writing to the configuration file in the user's APPDATA directory or by using the -settingsDir command-line argument to point to a malicious directory. This can be used as a persistence mechanism, as the injected command appears as a legitimate menu item. The issue is fixed in version 8.9.6.1 by adding user confirmation dialogs.
Affected products
- Notepad++ Notepad++ < 8.9.6.1
Timeline
- 2026-05-26: patched: Fix committed to repository
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: CVE published to NVD