By vendor
Notepad-Plus-Plus vulnerabilities
Known CVEs affecting Notepad-Plus-Plus products, prioritized by severity, with SEC.co remediation and detection guidance.
6 published vulnerabilities
- CVE-2026-46710HIGH 7.8
Notepad++ versions 8.9.4 through 8.9.6 contain a local privilege escalation flaw in the Windows installer. The installer runs PowerShell without specifying a full file path after changing to a custom installation directory. An attacker who can place a fake powershell.exe in a user-writable directory could trick a privileged user into running the malicious executable during installation, granting it administrator-level access. The vulnerability has been resolved in version 8.9.6.
- CVE-2026-48778HIGH 7.8
Notepad++ contains a vulnerability where a malicious actor with local access to a user's computer can modify a configuration file to execute arbitrary commands with the privileges of the user running Notepad++. The vulnerability exists because Notepad++ reads a command-line interpreter setting from its config.xml file without verifying that the value is legitimate, then uses that untrusted value directly when the user attempts to open a command prompt in a folder. This allows attackers to replace the legitimate command interpreter path with malicious code that runs silently when triggered. The vulnerability affects versions prior to 8.9.6.1.
- CVE-2026-48800HIGH 7.8
Notepad++ versions before 8.9.6.1 allow arbitrary command injection through the shortcuts configuration file. An attacker who can modify the shortcuts.xml file—either directly or by tricking a user into importing a malicious configuration—can inject shell commands that execute with the user's privileges when that menu item is clicked. Because the injected command appears as a normal entry in the Run menu, this creates both an execution risk and a stealthy persistence mechanism.
- CVE-2026-52884HIGH 7.8
Notepad++ versions up to 8.9.6.1 contain a path traversal vulnerability that allows an attacker to bypass security checks and execute arbitrary programs from untrusted locations. When a user attempts to run an external command through Notepad++'s Run dialog, the application checks whether the target executable is in a trusted directory. However, this check uses a simple string-matching approach that can be circumvented by embedding path traversal sequences (like ..\..) after the trusted directory name. An attacker can craft a malicious file path that appears to pass the security check but actually resolves to an executable in an untrusted location, leading to arbitrary code execution if a user is tricked into running it. The issue is resolved in version 8.9.6.2.
- CVE-2026-52885MEDIUM 6.3
Notepad++ versions before 8.9.6.4 contain a time-of-check-time-of-use (TOCTOU) vulnerability in how it validates user-defined commands. The application verifies the integrity of the shortcuts.xml configuration file at the moment a command executes, but it uses the command payload that was loaded into memory when the application started. An attacker with local write access to the shortcuts.xml file can exploit this gap by placing a malicious command definition before Notepad++ launches, then replacing the file with a legitimate version before any command runs. The integrity check passes because it validates the now-clean file, but the malicious command from memory executes anyway. This requires local file system access and user interaction to trigger a command, limiting but not eliminating the practical risk.
- CVE-2026-48770MEDIUM 5.0
Notepad++ versions before 8.9.6.1 contain a local denial-of-service vulnerability where a malicious process running on the same Windows session can crash the application by sending a specially crafted message. The vulnerability stems from improper validation of inter-process communication data, allowing an attacker to trigger a memory access violation without requiring special privileges beyond standard user-level access.