Executive brief
Notepad++ is a popular open-source text and source code editor. A security flaw allows an attacker with local file access to bypass security checks and execute unauthorized commands. By swapping a configuration file during the application's startup process, an attacker can trick the software into running malicious code while appearing to validate a legitimate file. This could lead to a full system compromise or unauthorized data access on the user's machine.
Technical details
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in Notepad++ versions prior to 8.9.6.4 within the HMAC validation logic for user commands. The application populates an internal memory vector (_userCommands) with command payloads from 'shortcuts.xml' at startup. When a command is triggered, the software performs an HMAC integrity check against the 'shortcuts.xml' file currently on disk; however, it then executes the command stored in memory rather than the one just validated on disk. An attacker with local write access can place a malicious 'shortcuts.xml' file on disk before launch to populate the memory vector, then quickly replace it with a legitimate version. The subsequent HMAC check succeeds against the legitimate file, but the malicious command from memory is executed. This vulnerability is addressed in version 8.9.6.4 by ensuring the HMAC check and execution use consistent data.
Affected products
- Notepad++ Notepad++ < 8.9.6.4
Timeline
- 2026-06-04: advisory: GitHub Security Advisory GHSA-qm4c-qg8p-qfcr published
- 2026-06-26: disclosed: CVE-2026-52885 published to NVD