Executive brief
Notepad++ is a widely-used source code editor for Windows. When a user right-clicks a file and selects "Run by system," Notepad++ can be tricked into executing an attacker's command script instead of the user's file if the attacker has placed a malicious .cmd file with the same name in the same directory. This allows arbitrary code execution with the user's privileges.
Technical details
The vulnerability exists in the Folder as Workspace "Run by system" functionality, which fails to properly resolve the target file path when a sibling .cmd file with the same name exists. An attacker can exploit this by placing a malicious command script alongside a legitimate text file, causing the shell to execute the attacker's script when the user invokes the action on the selected file. The issue affects Windows 10 and 11 and was fixed in version 8.9.8 by using the "\\?\" prefix to ensure exact path resolution.
Affected products
- Notepad++ Notepad++ prior to 8.9.8
Timeline
- 2026-09-22: disclosed
- 2026-08-23: patched