EUVD-2026-39907Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 26, 2026
Local code execution in Notepad++ before 8.9.6.1 occurs because the <GUIConfig name="commandLineInterpreter"> value in config.xml is loaded into _nppGUI._commandLineInterpreter with no validation, whitelist, or signature check, then passed directly to ShellExecute when a user invokes File → Open Containing Folder → cmd. An attacker who can plant or modify config.xml runs an arbitrary executable in the victim's session the next time they use this menu action. Publicly available exploit code exists (Exploit-DB 52606), but there is no public exploit identified as actively exploited; the issue is not in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Notepad Plus Plus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 creates a Command object with this value and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. This vulnerability is fixed in 8.9.6.1.
Executive ViewAI
Notepad++ versions before 8.9.6.1 allow local code execution when users access the File → Open Containing Folder menu, if an attacker can modify the application's configuration file beforehand. This affects any organization where Notepad++ is installed on Windows workstations and users have regular access to file system operations, enabling privilege escalation and lateral movement via user sessions.
Within 24 hours: Identify all systems running Notepad++ versions before 8.9.6.1; restrict write permissions on %APPDATA%\Notepad++ and installation directories to prevent unauthorized config modifications. Within 7 days: Deploy file integrity monitoring on config.xml files; block execution of non-approved binaries via AppLocker or WDAC; disable or restrict the 'Open Containing Folder' feature via policy if operationally feasible. Within 30 days: Monitor Notepad++ security advisories and apply vendor patch immediately upon release; verify remediation across all endpoints.
Restrict write access to Notepad++ configuration and installation directories; implement file integrity monitoring on config.xml; enforce application allow-listing (AppLocker/Windows Defender Application Control) to restrict binary execution; deploy endpoint detection and response (EDR) to monitor abnormal process execution from Notepad++ and config.xml modifications; restrict user privileges to prevent unauthorized file writes in system directories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
Exploit-DB
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Notepad Plus Plus
View allNotepad++ versions prior to 8.8.9 contain an update integrity verification vulnerability (CVE-2025-15556) when using the
Loading a crafted Notepad++ plugin that reports more than 30 external lexers can overflow a 30-element stack array insid
Notepad++ installations prior to 8.9.8 crash when a local attacker can control the -settingsDir= command-line argument a
Arbitrary code execution in Notepad++ prior to 8.9.8 on Windows 10 and Windows 11 occurs when the editor's 'Folder as Wo
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msim
Notepad++ is a free and open-source source code editor. Rated high severity (CVSS 7.8), this vulnerability is no authent
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (Ux
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode ch
Improper signature verification in the Notepad++ updater path allows a locally planted or modified GUP.exe updater binar
Notepad++ versions before 8.9.2 allow local code execution through an unsafe search path vulnerability that permits atta
Notepad++ releases prior to 8.9.8 enforce their shortcuts.xml HMAC integrity check on the Macro menu and keyboard-shortc
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add(). Rated medium severity (CVSS