CVE-2026-48778: Notepad++ Config Injection Remote Code Execution (v8.9.6.1)

Technical summary

The vulnerability stems from insufficient input validation in Notepad++'s configuration handling. Specifically, the NppXml::value() function in Parameters.cpp reads the commandLineInterpreter tag from config.xml and stores it in _nppGUI._commandLineInterpreter without any sanitization, allowlist, or cryptographic verification. When a user invokes File → Open Containing Folder → cmd (IDM_FILE_OPEN_CMD), NppCommands.cpp constructs a Command object using this unvalidated value and passes it to ShellExecute via RunDlg.cpp. Since ShellExecute interprets the string as an executable path, an attacker can inject an arbitrary executable path or command. The issue is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), which broadly covers OS command injection vulnerabilities. Local file write access to config.xml is the primary prerequisite.

Business impact

This vulnerability creates risk primarily for multi-user systems or shared workstations where an attacker can modify the Notepad++ configuration file. Compromise of developer machines is particularly concerning, as it could enable supply chain attacks or theft of source code and intellectual property. The attack requires local filesystem access but no special privileges, making it relevant in scenarios involving compromised accounts, insider threats, or physical access. Organizations using Notepad++ for development or documentation workflows should prioritize remediation to prevent unauthorized code execution and data exfiltration.

Affected systems

Notepad++ versions prior to 8.9.6.1 are vulnerable. This affects both 32-bit and 64-bit installations across Windows systems. The vulnerability requires an attacker to have write access to the target user's Notepad++ configuration directory (typically %APPDATA%\Notepad++\), which is achievable through compromised user accounts, malware with filesystem access, or physical access to an unlocked system.

Exploitability

Exploitation requires two conditions: (1) an attacker must achieve write access to the victim's Notepad++ config.xml file, and (2) the victim must manually trigger the 'Open Containing Folder → cmd' action from the File menu. The first condition is non-trivial in well-managed environments but feasible in scenarios involving credential compromise or lateral movement. The second condition depends on user behavior. Once the config.xml is modified, the attacker does not need to interact further; the attack is triggered by normal user action. No patching of the application is required on the attacker's side, making this a post-compromise exploitation vector rather than a remote code execution threat.

Remediation

Update Notepad++ to version 8.9.6.1 or later immediately. The patch addresses the vulnerability by implementing validation of the commandLineInterpreter configuration value before it is used in command execution. Users should also verify that their config.xml files have not been tampered with, particularly if they suspect prior compromise. In high-security environments, consider restricting write permissions on the Notepad++ configuration directory via NTFS ACLs to prevent unauthorized modification.

Patch guidance

Download and install Notepad++ version 8.9.6.1 or a newer stable release from the official Notepad++ repository or website. The update is available as a standard installer and as a portable version. Test the update in a non-production environment if possible. Existing configuration files will migrate automatically; no manual configuration steps are required. Verify that the application launches and functions normally after the update. For large deployments, consider using automated patch management tools or scripts to ensure consistent rollout across the organization.

Detection guidance

Monitor for modifications to Notepad++ configuration files (config.xml) in user profile directories (%APPDATA%\Notepad++\), particularly unexpected changes to the commandLineInterpreter tag. Use file integrity monitoring (FIM) solutions to alert on unauthorized writes. In endpoint detection and response (EDR) systems, monitor for unusual child processes spawned from Notepad++.exe, especially those that execute unexpected binaries or scripts. Check for the presence of commandLineInterpreter entries that deviate from the standard path (typically system32\cmd.exe or powershell.exe). Log and analyze calls to ShellExecute originating from RunDlg.cpp or NppCommands.cpp if application-level instrumentation is available.

Why prioritize this

This vulnerability merits HIGH priority due to its CVSS 3.1 score of 7.8 and the potential for reliable local privilege escalation or lateral movement post-compromise. While it requires prior filesystem access, it enables an attacker to escalate from a low-privilege compromised account to code execution in the context of a developer or administrator. Supply chain risk is particularly acute if development machines are affected. However, it is not CRITICAL because it is local-only and user-action dependent. Organizations should patch promptly but may sequence remediation after addressing remote code execution vulnerabilities in externally exposed services.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a low attack vector (AV:L—local access required) but high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). Attack complexity is low (AC:L), no special privileges are required (PR:N), and user interaction is required (UI:R) to trigger the payload. The scope is unchanged (S:U). The score appropriately captures the threat of arbitrary code execution in a local context; it is elevated by the fact that the attack succeeds silently once the config is poisoned and the user performs a routine action.

Frequently asked questions