CVE-2026-48800
Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 7.8EPSS 0.4%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
31 May 2026Public PoC
26 Jun 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserCommand._cmd without any validation. When the user clicks the corresponding entry in the Run menu, NppCommands.cpp:4264 creates a Command object with string2wstring(ucmd.getCmd()) and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. The injected command appears as a normal menu item in the Run menu, making it a viable persistence mechanism. This vulnerability is fixed in 8.9.6.1.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
notepad-plus-plus · notepad-plus-pluspublic PoCs found — 1
githubgithub.com/kavin-jindal/CVE-2026-48800-PoC★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →