Notepad++ up to 8.9.6 NppXml::value Parameters.cpp UserCommand os command injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in Notepad++ up to 8.9.6. Affected is the function UserCommand of the file Parameters.cpp of the component NppXml::value. Performing a manipulation results in os command injection. This vulnerability is cataloged as CVE-2026-48800. The attack must be initiated from a local position. Furthermore, there is an exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Notepad++ up to 8.9.6. It has been classified as critical. This affects the function UserCommand of the file Parameters.cpp of the component NppXml::value. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserCommand._cmd without any validation. When the user clicks the corresponding entry in the Run menu, NppCommands.cpp:4264 creates a Command object with string2wstring(ucmd.getCmd()) and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. The injected command appears as a normal menu item in the Run menu, making it a viable persistence mechanism. This vulnerability is fixed in 8.9.6.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-48800. The exploitability is told to be easy. Attacking locally is a requirement. Technical details and a public exploit are known. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

The exploit is shared for download at github.com. It is declared as proof-of-concept.

Upgrading to version 8.9.6.1 eliminates this vulnerability. The upgrade is hosted for download at notepad-plus-plus.org. Applying the patch 6b3dc52a9245c6d8c6287a8d6d93a30981c05feb is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Document Reader Software

Name

• Notepad++

Version

• 8.9.0
• 8.9.1
• 8.9.2
• 8.9.3
• 8.9.4
• 8.9.5
• 8.9.6

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion