What is the CVSS score of CVE-2026-48800?

CVE-2026-48800 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Notepad++ are affected by CVE-2026-48800?

Notepad++ versions prior to 8.9.6.1 contain a local command injection vulnerability that allows attackers to inject malicious executables into user Run menus, creating a persistent backdoor mechanism…. A patch is available.

How to fix or mitigate CVE-2026-48800?

Within 24 hours: Identify all systems with Notepad++ deployment and document current versions; prioritize development and analyst workstations. Within 7 days: Test and deploy Notepad++ 8.9.6.1 to pilot group of high-risk systems. Within 30 days: Complete mandatory upgrade to Notepad++ 8.9.6.1 across all organizational systems.

Notepad++ CVE-2026-48800

EUVD-2026-39904 HIGH

OS Command Injection (CWE-78)

2026-06-26 GitHub_M

Command Injection Notepad Plus Plus

7.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local config-file injection executed only after the victim clicks the menu item gives AV:L/UI:R; arbitrary code runs as the user with full C/I/A impact; no app privileges are required to author the XML, so PR:N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Jun 26, 2026 - 21:23 vuln.today

Analysis Generated

Jun 26, 2026 - 21:23 vuln.today

DescriptionCVE.org

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserCommand._cmd without any validation. When the user clicks the corresponding entry in the Run menu, NppCommands.cpp:4264 creates a Command object with string2wstring(ucmd.getCmd()) and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. The injected command appears as a normal menu item in the Run menu, making it a viable persistence mechanism. This vulnerability is fixed in 8.9.6.1.

AnalysisAI

Local OS command injection in Notepad++ before 8.9.6.1 lets an attacker who can write to a user's shortcuts.xml inject an arbitrary executable path into a <Command> entry under <UserDefinedCommands>, which feedUserCmds() loads into UserCommand._cmd with no validation and later passes straight to ShellExecute when the victim clicks the corresponding Run-menu item. Because the malicious entry renders as an ordinary Run-menu item, it doubles as a stealthy persistence mechanism that executes attacker-chosen binaries in the victim's user context. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the fix is confirmed in release 8.9.6.1.

Technical ContextAI

Notepad++ is a widely used open-source Windows source-code editor whose Run menu supports user-defined commands persisted in the shortcuts.xml configuration file. At Parameters.cpp:3658, NppXml::value(aNode) reads the text content of each <Command> tag inside <UserDefinedCommands> and stores it verbatim in UserCommand._cmd. When the menu item is invoked, NppCommands.cpp:4264 builds a Command object via string2wstring(ucmd.getCmd()) and calls run(), which reaches ShellExecute at RunDlg.cpp:221 using the stored string as the executable path. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): configuration-sourced data is treated as a trusted command line with no path validation, allowlisting, or trust-location check, so any value placed in that XML field is executed. The fix commit (6b3dc52) adds runtime security checks - rejecting non-absolute paths, missing files, and untrusted/unsafe-URL targets, and warning on executables from untrusted locations.

RemediationAI

Upgrade to Notepad++ 8.9.6.1 or later, which is the vendor-released patch (8.9.6.1) that adds path and trust validation before ShellExecute (commit 6b3dc52). Reference the advisory GHSA-3x3f-3j39-pj3v for details. If immediate patching is not possible, treat shortcuts.xml as a sensitive file: restrict NTFS write permissions on each user's %AppData%\Notepad++\shortcuts.xml (and the installation-directory copy) so only the owning user/administrators can modify it, audit the <UserDefinedCommands> section for unexpected <Command> entries pointing at non-absolute paths or untrusted locations, and remove any you did not create - the trade-off is that legitimate custom Run commands must be re-added and maintained manually. Monitoring file-integrity on shortcuts.xml is a low-impact compensating control that detects tampering without breaking functionality.