CVE-2026-48800: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-48800 is an OS command injection vulnerability in Notepad++ that allows arbitrary code execution via a maliciously crafted shortcuts.xml configuration file. Affecting all versions prior to 8.9.6.1, the flaw was disclosed on May 27, 2026 via a GitHub Security Advisory and published to NVD on June 26, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause (CWE-78: OS Command Injection) lies in the feedUserCmds() function in Parameters.cpp (line 3658), where NppXml::value(aNode) reads the text content of <Command> tags inside <UserDefinedCommands> in shortcuts.xml and stores it in UserCommand._cmd without any sanitization or validation. When the user clicks the corresponding Run menu entry, NppCommands.cpp:4264 constructs a Command object from the unsanitized string and calls run(), which passes the attacker-controlled value directly to ShellExecute in RunDlg.cpp:221 as the executable path. Exploitation requires local write access to %APPDATA%\Notepad++\shortcuts.xml (same-user privilege) and a single user interaction — clicking the injected menu item. A public PoC Python script and XML payload are available (GitHub Advisory, PoC Repo).

Successful exploitation allows an attacker with local file-write access to execute arbitrary OS commands with the full privileges of the user running Notepad++, resulting in high confidentiality, integrity, and availability impact. Because the injected command appears as a legitimate-looking Run menu item (e.g., "System Update Check"), it functions as a stealthy persistence mechanism that survives reboots. An attacker who gains temporary access to the system can plant the backdoor command in shortcuts.xml, enabling ongoing code execution each time the victim interacts with the Run menu (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target Windows system running Notepad++ version ≤ 8.9.6 where the attacker has local write access to the user's %APPDATA%\Notepad++\ directory.
2. Craft malicious payload: Prepare a malicious <Command> entry for injection into shortcuts.xml, such as:

<Command name="System Update Check" Ctrl="no" Alt="no" Shift="no" Key="0">calc.exe</Command>

Replace calc.exe with any desired executable or script path. 3. Inject into shortcuts.xml: Write the malicious <Command> tag inside the <UserDefinedCommands> section of %APPDATA%\Notepad++\shortcuts.xml via one of these vectors:

• Direct file write (same-user privilege)
• Deploying a malicious .lnk shortcut using the -settingsDir= argument to point Notepad++ to an attacker-controlled configuration directory

4. Wait for user interaction: The injected command appears as a normal, legitimate-looking entry in Notepad++'s Run menu (e.g., "System Update Check").
5. Trigger execution: When the victim clicks the injected Run menu item, Notepad++ passes the unsanitized command string to ShellExecute, executing the attacker-specified binary with the user's privileges.
6. Achieve persistence: The injected entry persists across reboots as long as shortcuts.xml is not cleaned, providing ongoing code execution capability (GitHub Advisory, PoC Repo).

• File System:
  • Unexpected or modified %APPDATA%\Notepad++\shortcuts.xml containing <Command> entries under <UserDefinedCommands> with executable paths (e.g., .exe, .bat, .ps1, .cmd) not added by the user via the GUI
  • Presence of attacker-controlled configuration directories referenced via -settingsDir= in Notepad++ shortcuts (.lnk files)
• Process:
  • Unusual child processes spawned by notepad++.exe (e.g., calc.exe, cmd.exe, powershell.exe, wscript.exe, or other executables not typical for a text editor)
  • Processes launched from unexpected paths (e.g., %APPDATA%, %TEMP%, user-writable directories) with notepad++.exe as parent
• Logs:
  • Windows Event Log (Security/Process Creation, Event ID 4688) showing notepad++.exe as parent process for unexpected child processes
  • Sysmon Event ID 1 (Process Create) with notepad++.exe as ParentImage and suspicious CommandLine values
• Network:
  • Outbound network connections initiated by processes spawned from notepad++.exe to unknown or suspicious external IPs/domains (GitHub Advisory, KQL Detection)

Upgrade Notepad++ to version 8.9.6.1 or later, which adds security validation logic in RunDlg.cpp including path resolution, trusted-directory checks, risky-extension warnings, and user confirmation dialogs before executing UserCommand entries (GitHub Commit, GitHub Advisory). As a workaround prior to patching, restrict file system write access to %APPDATA%\Notepad++\ to prevent unauthorized modification of shortcuts.xml, and audit the file for unexpected <Command> entries under <UserDefinedCommands>. Versions 8.9.6.2 and 8.9.6.4 have also been released as subsequent updates (Notepad++ v8.9.6.2, Notepad++ v8.9.6.4).

The vulnerability received notable coverage from security news outlets including Heise, GBHackers, CSO Online, and Cyber Security News, with several articles highlighting the arbitrary code execution risk on Windows systems (Heise, GBHackers, CSO Online). The Hacker News included it in a weekly recap of notable vulnerabilities (The Hacker News). Community discussion appeared on Reddit's CVEWatch and pwnhub subreddits, and a KQL detection rule was published on GitHub for Microsoft Defender/Sentinel users (KQL Detection). Qualys and Tenable both released detection plugins for the vulnerability (Qualys, Tenable).