Donho

**Name of the Vulnerable Software and Affected Versions** Notepad++ versions prior to 8.9.6.4 **Description** A Time-of-Check to Time-of-Use (TOCTOU) flaw exists in `NppCommands.cpp`. The application validates the HMAC of the `shortcuts.xml` file on disk when a user command is triggered, but it executes the command payload from the ` userCommands` vector stored in memory, which is populated during startup and not re-synchronized. An attacker with write access to `shortcuts.xml` can replace the file with a malicious version before the application starts and then restore the original file. This allows the HMAC check to pass against the legitimate file while the malicious payload is executed from memory. **Recommendations** Update to version 8.9.6.4.