EUVD-2026-39906Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-swap race (AV:L/AC:H); attacker needs write access to the victim's config file (PR:L) and the user must trigger a command (UI:R); full command execution gives C/I/A High.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.4, NppCommands.cpp checks the HMAC of the on-disk shortcuts.xml at the moment a user command fires (Time-of-Check). However, the command payload is taken from the in-memory _userCommands vector, which is populated at application startup and never re-synchronized with the on-disk file (Time-of-Use). Swapping shortcuts.xml between startup and command execution causes the HMAC check to validate a clean file while a malicious command runs. An attacker with write access to shortcuts.xml places a malicious version on disk before launch, then immediately restores the legitimate file. The HMAC check at execution time validates the restored legitimate file (check passes), while the malicious payload executes from memory. This vulnerability is fixed in 8.9.6.4.
AnalysisAI
Local code execution in Notepad++ before 8.9.6.4 stems from a time-of-check/time-of-use race in NppCommands.cpp: the integrity HMAC of shortcuts.xml is verified against the on-disk file when a command fires, but the command payload is read from the _userCommands vector loaded at startup and never re-synced with disk. An attacker with write access to shortcuts.xml can plant a malicious version before launch and restore the legitimate file afterward, so the runtime HMAC check passes on the clean file while the malicious in-memory command executes. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; it is fixed in 8.9.6.4.
Technical ContextAI
Notepad++ stores user-defined command shortcuts in shortcuts.xml and protects that file's integrity with an HMAC keyed on the machine GUID (computeHMAC over getMachineGUID() and the file content), comparing the disk value against a value persisted in config.xml. The root cause is CWE-367 (Time-of-Check Time-of-Use Race Condition): the check (computeHMAC of the current on-disk shortcuts.xml at command() execution) and the use (the _userCommands vector populated once during NppParameters::load() at startup) reference two different points in time and are never reconciled. The fix changes Parameters.cpp/Parameters.h to compute and cache the disk HMAC at load time into a new _shortcutsOnDiskHmac field and compares that cached, load-time value (nppGUI._shortcutsOnDiskHmac vs nppGUI._shortcutsXmlHmacInConfig) instead of recomputing it from disk at command time, closing the swap window. Affected component per CPE is cpe:2.3:a:notepad-plus-plus:notepad-plus-plus.
RemediationAI
Vendor-released patch: upgrade Notepad++ to 8.9.6.4 or later, which caches the shortcuts.xml HMAC at startup (Parameters.cpp) and compares the cached load-time value instead of recomputing it at command time, eliminating the swap window; see advisory https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-qm4c-qg8p-qfcr and commit 4f7563c7c7f8ffa0d795ec86a7777067c7d644b5. Where immediate upgrade is not possible, restrict filesystem write permissions on the user's shortcuts.xml (under the Notepad++ config directory) so that only the owning user/process can modify it, which directly removes the attacker's ability to swap the file but does nothing if the attacker already controls the user account; additionally monitor or audit modifications to shortcuts.xml (e.g., file-integrity monitoring) to detect pre-launch tampering, accepting that this is detective rather than preventive. Avoid running Notepad++ from shared or world-writable profile locations.
More in Notepad Plus Plus
View allNotepad++ versions prior to 8.8.9 contain an update integrity verification vulnerability (CVE-2025-15556) when using the
Local code execution in Notepad++ before 8.9.6.1 occurs because the <GUIConfig name="commandLineInterpreter"> value in c
An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msim
Notepad++ is a free and open-source source code editor. Rated high severity (CVSS 7.8), this vulnerability is no authent
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (Ux
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode ch
Notepad++ versions before 8.9.2 allow local code execution through an unsafe search path vulnerability that permits atta
Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add(). Rated medium severity (CVSS
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Notepad++ is a free and open-source source code editor. Rated medium severity (CVSS 5.5), this vulnerability is no authe
Local OS command injection in Notepad++ before 8.9.6.1 lets an attacker who can write to a user's shortcuts.xml inject a
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today