CVE-2026-48800: Notepad++ Command Injection via shortcuts.xml (CVSS 7.8)

Technical summary

The vulnerability exists in how Notepad++ parses the <Command> tag within <UserDefinedCommands> in shortcuts.xml. The NppXml::value() function in Parameters.cpp (line 3658) reads this XML content without validation and stores it directly into UserCommand._cmd. When a user invokes the corresponding Run menu entry, NppCommands.cpp (line 4264) constructs a Command object using string2wstring(ucmd.getCmd()) and executes it via ShellExecute (RunDlg.cpp:221) with no sanitization. This allows arbitrary command-line arguments and executable paths. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Business impact

If an attacker gains write access to a user's Notepad++ configuration directory or convinces a user to import a malicious shortcuts.xml profile, arbitrary code execution occurs under the user's security context. Because the malicious command masquerades as a legitimate menu item, detection is difficult. The risk is heightened in environments where configuration files are synchronized across systems (e.g., via cloud storage or configuration management tools), potentially affecting multiple machines from a single poisoned file. This vulnerability represents both immediate execution and lateral persistence risk.

Affected systems

Notepad++ versions prior to 8.9.6.1 are affected. The vulnerability affects all platforms where Notepad++ runs (Windows primarily, with varying support on other systems via community builds). Users with access to modify or import configuration files are at direct risk; those sharing configuration profiles or using centralized configuration management are at elevated risk.

Exploitability

Exploitation requires either direct file system write access to the user's Notepad++ configuration directory or social engineering to import a malicious shortcuts.xml file. The attack vector is local, the attack complexity is low, and user interaction (clicking the menu item) is required. No authentication or elevated privileges are needed to modify the configuration file if file permissions allow it. The CVSS 3.1 score of 7.8 (HIGH) reflects the combination of local attack surface, low complexity, and high impact on confidentiality, integrity, and availability.

Remediation

Upgrade Notepad++ to version 8.9.6.1 or later. The patch implements validation of command content in the shortcuts.xml parsing logic. Organizations should also audit user configuration directories and imported profiles for suspicious command entries, particularly those containing shell operators (pipes, redirects, semicolons) or unusual executable paths. Consider restricting write access to Notepad++ configuration directories where feasible.

Patch guidance

Users should update to Notepad++ 8.9.6.1 via the built-in updater or by downloading the latest release from the official Notepad++ website. Verify the update was successful by checking Help > About > Version. Organizations should test the update in a controlled environment before broad deployment. For environments that manage configuration centrally, regenerate or audit all shortcuts.xml files to ensure no injected commands remain in cached or backed-up versions.

Detection guidance

Monitor for suspicious entries in shortcuts.xml files, particularly those containing command operators or non-standard executable paths. Flag instances where the XML contains shell metacharacters, UNC paths, or references to scripting interpreters. Log and alert on any Notepad++ process spawning unexpected child processes, especially with arguments containing special characters. In endpoint detection and response (EDR) systems, correlate Notepad++ process execution with unusual command-line activity or process trees. Check recently modified shortcuts.xml files, especially following user sessions where configuration files were imported or edited.

Why prioritize this

This vulnerability merits prompt patching because it enables both direct code execution and stealthy persistence through a user-facing menu interface. The local attack vector, low complexity, and high impact make it attractive for post-breach lateral movement or supply-chain attacks targeting development teams. Although KEV inclusion is not reported, the straightforward exploit path and widespread use of Notepad++ in development environments elevates practical risk. Patch coverage should be prioritized in environments where developers frequently import shared configuration profiles.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) is justified by the combination of local attack vector, low attack complexity, lack of required privileges, user interaction (clicking menu), and high impact across confidentiality, integrity, and availability. The severity is tempered only by the requirement for file write access and user action, but those constraints are easily met in collaborative or supply-chain scenarios where configuration sharing is common.

Frequently asked questions