PT-2026-44400

CVE-2026-48778

Published

2026-05-26

Updated

2026-09-09

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.6.1

Description An issue exists in the processing of the commandLineInterpreter parameter within the config.xml configuration file. The software fails to neutralize special elements, which allows an attacker to replace cmd.exe with malicious executables via unvalidated config.xml files, leading to arbitrary code execution on the victim's machine.

Recommendations Update to version 8.9.6.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Michele Piccinni

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers