Threats affecting pkg:github/dail8859/NotepadNext

CVE-2026-42214 is a code injection vulnerability in NotepadNext versions prior to 0.14. The detectLanguageFromExtension() function unsafely interpolates a file extension into a Lua script without sanitization, allowing an attacker to execute arbitrary Lua code by crafting a malicious file extension. Because the full Lua standard libraries are loaded, this can lead to arbitrary command execution. This vulnerability has been patched in NotepadNext version 0.14.

Out-of-bounds Write vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with program files ldebug.C, lvm.C. This issue affects NotepadNext: through v0.11.

Out-of-bounds Read vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with program files lparser.C. This issue affects NotepadNext: through v0.11. The singlevar() in lparser.c lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.