CVE-2026-48778: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-48778 is an OS command injection vulnerability in Notepad++ that allows a local attacker to achieve arbitrary code execution by poisoning the <GUIConfig name="commandLineInterpreter"> tag in config.xml. All Notepad++ versions prior to 8.9.6.1 are affected. The vulnerability was published on May 26, 2026, and patched in version 8.9.6.1 released shortly after. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause (CWE-78: OS Command Injection) lies in Parameters.cpp:6430, where NppXml::value() reads the commandLineInterpreter value from config.xml and stores it in _nppGUI._commandLineInterpreter without any validation, whitelist enforcement, or digital signature verification. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 constructs a Command object using this attacker-controlled string and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the poisoned value as the executable path. Attack vectors for poisoning config.xml include direct write access at the same user privilege level (%APPDATA%\Notepad++\config.xml), malicious .lnk shortcuts using the -settingsDir= flag, cloud sync poisoning via Notepad++'s cloud path feature, and social engineering to extract a malicious archive into AppData. The fix removes the commandLineInterpreter configuration entirely and hardcodes %COMSPEC% for cmd and a registry-resolved path for PowerShell (GitHub Advisory, Patch Commit).

Successful exploitation allows a local attacker to execute arbitrary operating system commands with the privileges of the user running Notepad++, resulting in high confidentiality, integrity, and availability impact. An attacker can launch any executable — including malware, reverse shells, or ransomware — simply by waiting for the victim to use the "Open Containing Folder → cmd" menu option. While the attack vector is local, the vulnerability can be chained with other techniques (e.g., cloud sync poisoning or malicious shortcuts) to extend reach across shared environments or Windows domains (GitHub Advisory, Feedly).

1. Identify target: Confirm the victim is running Notepad++ version 8.9.6 or earlier on Windows.
2. Gain write access to config.xml: Obtain write access to %APPDATA%\Notepad++\config.xml via one of the following vectors: direct local access (same user privilege), a malicious .lnk shortcut using -settingsDir= pointing to an attacker-controlled directory, cloud sync poisoning (if the user has configured a cloud path), or social engineering to extract a malicious archive into AppData.
3. Inject malicious payload: Insert or modify the commandLineInterpreter tag in config.xml with the path to the desired executable:

   <GUIConfig name="commandLineInterpreter">C:\path\to\malware.exe</GUIConfig>

4. Wait for trigger: Wait for the victim to use File → Open Containing Folder → cmd (or right-click a tab → Open into → Open Containing Folder in cmd).
5. Achieve code execution: Notepad++ reads the poisoned value from config.xml without validation and passes it to ShellExecute, launching the attacker-specified executable with the victim's privileges (GitHub Advisory, kavin-jindal PoC).

• File System: Unexpected or modified %APPDATA%\Notepad++\config.xml containing a <GUIConfig name="commandLineInterpreter"> tag with a non-standard executable path (anything other than cmd.exe or %COMSPEC%); presence of malicious .lnk files with -settingsDir= arguments pointing to attacker-controlled directories.
• Process: Unusual child processes spawned by notepad++.exe (e.g., calc.exe, powershell.exe with encoded commands, mshta.exe, reverse shell binaries, or other unexpected executables) when the user triggers the "Open Containing Folder" menu action.
• Logs: Windows Security Event Log entries (Event ID 4688) showing process creation with notepad++.exe as the parent and an unexpected child process; Sysmon Event ID 1 logs capturing the same.
• Network: Outbound connections from processes spawned by notepad++.exe to external IPs, particularly shortly after the user interacts with the "Open Containing Folder → cmd" menu option.
• Registry/KQL Detection: Community-published KQL hunting queries for this CVE are available for advanced detection (KQL Detection).

The primary remediation is to upgrade Notepad++ to version 8.9.6.1 or later, which removes the commandLineInterpreter configuration entirely and hardcodes trusted system paths (%COMSPEC% for cmd, registry-resolved path for PowerShell) (Patch Commit, v8.9.6.1 Release). As a workaround prior to patching, restrict write permissions on %APPDATA%\Notepad++\config.xml to prevent unauthorized modification. Additionally, avoid using the "Open Containing Folder → cmd" feature until the patch is applied, and audit any .lnk shortcuts or cloud-synced Notepad++ configuration directories for tampering.

The vulnerability received notable media coverage, with outlets including Heise, CSO Online, GBHackers, and CyberSecurityNews reporting on the flaw and its potential for arbitrary code execution on Windows systems (Heise, CSO Online). The CVE appeared in multiple weekly trending CVE roundups on Reddit's r/CVEWatch and r/pwnhub communities. Qualys published a dedicated threat advisory, and Tenable added detection support via Nessus plugin 318684 (Qualys Advisory, Tenable). The Notepad++ project responded promptly with a patch and community forum announcement, and the official Bluesky account acknowledged the release (Notepad++ Community).