EUVD-2026-39903Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local Run-command trigger with no privileges but mandatory user interaction; successful code execution in the user's context yields full C/I/A impact, matching AV:L/PR:N/UI:R.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with trusted directory strings. A path traversal using ..\..\ after a trusted directory prefix passes the check while resolving to an untrusted location. The CVE-2026-48800 patch adds isInTrustedDirectory() validation in Command::run() (RunDlg.cpp) before calling ShellExecute(). This function checks whether the resolved executable path is under a trusted directory. This vulnerability is fixed in 8.9.6.2.
AnalysisAI
Trusted-directory validation bypass in Notepad++ 8.9.6.1 lets a crafted executable path defeat the isInTrustedDirectory() check added by the prior CVE-2026-48800 fix, allowing arbitrary code execution via the Run command. Because the check uses a prefix match (PathIsPrefix-style) without canonicalizing the path first, a string beginning with a trusted directory but containing ..\..\ traversal resolves to an untrusted location yet still passes validation, causing ShellExecute() to launch an attacker-controlled binary. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; it requires local user interaction and is fixed in 8.9.6.2.
Technical ContextAI
The flaw lives in Command::run() in RunDlg.cpp, which implements the editor's user-facing Run feature that hands a command string to the Windows ShellExecute() API. CVE-2026-48800 introduced isInTrustedDirectory() to confine launched executables to known-safe directories, but the implementation performs a lexical prefix comparison against the trusted-directory string instead of first resolving the path to its canonical form (e.g., via GetFullPathName/PathCanonicalize). This is a classic CWE-42 (path-equivalence) / path-traversal weakness: tokens such as ..\..\ embedded after a legitimate trusted prefix survive the textual check but are collapsed by the filesystem at execution time, so the security gate and the actual target diverge. CPE cpe:2.3:a:notepad-plus-plus:notepad-plus-plus identifies the affected Windows source-code editor; the patch commit also pulls in an unrelated hmac/bcrypt build change, but the security-relevant fix is the canonicalization-before-comparison logic in the Run path.
RemediationAI
Vendor-released patch: 8.9.6.2 - upgrade all Windows installations of Notepad++ from 8.9.6.1 to 8.9.6.2 or later, which canonicalizes the path before the trusted-directory comparison. Track the fix via advisory GHSA-p58x-r3c9-x9p6 (https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-p58x-r3c9-x9p6) and commit ea1508855e9c4528f6198ce9d345f13cb759ebf4. Where immediate patching is not possible, avoid opening Notepad++ sessions, project/config files, or documents from untrusted sources and do not invoke the Run command on untrusted content, since exploitation depends on that user action; on managed endpoints, application-allowlisting (e.g., AppLocker/WDAC) that blocks execution of binaries from user-writable or non-standard directories provides a compensating control, with the trade-off that it may interfere with legitimate Run-command workflows that launch helper tools from non-standard paths.
More in Notepad Plus Plus
View allNotepad++ versions prior to 8.8.9 contain an update integrity verification vulnerability (CVE-2025-15556) when using the
Local code execution in Notepad++ before 8.9.6.1 occurs because the <GUIConfig name="commandLineInterpreter"> value in c
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msim
Notepad++ is a free and open-source source code editor. Rated high severity (CVSS 7.8), this vulnerability is no authent
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (Ux
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode ch
Notepad++ versions before 8.9.2 allow local code execution through an unsafe search path vulnerability that permits atta
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add(). Rated medium severity (CVSS
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Local OS command injection in Notepad++ before 8.9.6.1 lets an attacker who can write to a user's shortcuts.xml inject a
Same technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today