What is the CVSS score of CVE-2026-48778?

CVE-2026-48778 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.4%.

Which versions of Notepad Plus Plus are affected by CVE-2026-48778?

Notepad++ versions before 8.9.6.1 allow local code execution when users access the File → Open Containing Folder menu, if an attacker can modify the application's configuration file beforehand.. A patch is available.

Is there a public PoC exploit available for CVE-2026-48778?

Yes, a public proof-of-concept exploit is available for CVE-2026-48778. Prioritise patching immediately. EPSS: 1.4%.

How to fix or mitigate CVE-2026-48778?

Within 24 hours: Identify all systems running Notepad++ versions before 8.9.6.1; restrict write permissions on %APPDATA%\Notepad++ and installation directories to prevent unauthorized config modifications. Within 7 days: Deploy file integrity monitoring on config.xml files; block execution of non-approved binaries via AppLocker or WDAC; disable or restrict the 'Open Containing Folder' feature via policy if operationally feasible. Within 30 days: Monitor Notepad++ security advisories and apply vendor patch immediately upon release; verify remediation across all endpoints.

Notepad Plus Plus CVE-2026-48778

EUVD-2026-39907 HIGH

OS Command Injection (CWE-78)

2026-06-26 GitHub_M

Command Injection Notepad Plus Plus

7.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Jun 26, 2026 - 21:24 vuln.today

Analysis Generated

Jun 26, 2026 - 21:24 vuln.today

DescriptionCVE.org

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 creates a Command object with this value and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. This vulnerability is fixed in 8.9.6.1.

AnalysisAI

Local code execution in Notepad++ before 8.9.6.1 occurs because the <GUIConfig name="commandLineInterpreter"> value in config.xml is loaded into _nppGUI._commandLineInterpreter with no validation, whitelist, or signature check, then passed directly to ShellExecute when a user invokes File → Open Containing Folder → cmd. An attacker who can plant or modify config.xml runs an arbitrary executable in the victim's session the next time they use this menu action. Publicly available exploit code exists (Exploit-DB 52606), but there is no public exploit identified as actively exploited; the issue is not in CISA KEV.