{"id":"CVE-2026-48778","summary":"Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter","details":"Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the \u003cGUIConfig name=\"commandLineInterpreter\"\u003e tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 creates a Command object with this value and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. This vulnerability is fixed in 8.9.6.1.","aliases":["GHSA-7hm3-wp5q-ccv9"],"modified":"2026-08-12T16:25:29.450385Z","published":"2026-06-26T20:21:17.254Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48778.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-78"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48778.json"},{"type":"ADVISORY","url":"https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48778"},{"type":"FIX","url":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/notepad-plus-plus/notepad-plus-plus","events":[{"introduced":"0"},{"fixed":"41dd976310db0ba551bb8a2810b60331df3a77f5"},{"fixed":"24c7b5c63cece76dbc8c4f2607a27ebfe22fa614"}],"database_specific":{"cpe":"cpe:2.3:a:notepad-plus-plus:notepad\\+\\+:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"8.9.6.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v8.9.6","v8.9.5","v8.9.4","v8.9.3","v8.9.2","v8.9.1","v8.9","v8.8.9","v8.8.8","v8.8.7","v8.8.6","v8.8.5","v8.8.4","v8.8.3","v8.8.2","v8.8.1","v8.8","v8.7.9","v8.7.8","v8.7.7","v8.7.6","v8.7.5","v8.7.4","v8.7.3","v8.7.2","v8.7.1","v8.7","v8.6.9","v8.6.8","v8.6.7","v8.6.6","v8.6.5","v8.6.4","v8.6.3","v8.6.2","v8.6.1","v8.6","v8.5.8","v8.5.7","v8.5.6","v8.5.5","v8.5.4","v8.5.3","v8.5.2","v8.5.1","v8.5","v8.4.9","v8.4.8","v8.4.7","v8.4.6","v8.4.5","v8.4.4","v8.4.3","v8.4.2","v8.4.1","v8.4","v8.3.3","v8.3.2","v8.3.1","v8.3","v8.2.1","v8.2","v8.1.9.3","v8.1.9.2","v8.1.9.1","v8.1.9","v8.1.8","v8.1.7","v8.1.6","v8.1.5","v8.1.4","v8.1.3","v8.1.2","v8.1.1","v8.1","v8","v7.9.5","v7.9.4","v7.9.3","v7.9.2","v7.9.1","v7.9","v7.8.9","v7.8.8","v7.8.7","v7.8.6","v7.8.5","v7.8.4","v7.8.3","v7.8.2","v7.8.1","v7.8","v7.7.1","v7.7","v7.6.6","v7.6.5","v7.6.4","v7.6.3","v7.6.2","v7.6.1","v7.6","v7.5.9","v7.5.8","v7.5.7","v7.5.6","v7.5.5","v7.5.4","v7.5.3","v7.5.2","v7.5.1","v7.4.2","v7.4.1","v7.4","v7.3.3","v7.3.2","v7.3.1","7.3.1","v7.3","v7.2.2","7.2.2","v7.2.1","v7.2","v7.1","v7","v6.9.2","v6.9.1","v6.9","v6.8.9","v6.8.8","v6.8.7","v6.8.6","v6.8.5","v6.8.4","v6.8.3","v6.8.2","v6.8.1","v6.8","v6.7.9.2","v6.7.9.1","v6.7.9","v6.7.8.2","v6.7.8.1","v6.7.8","v6.7.7","v6.7.5","v6.7.4_-_Je_suis_Charlie_edition","v6.7.3","v6.7.2","v6.7.1","v6.7","v6.6.9","v6.6.8","v6.6.7","v6.6.6_-_Friday_the_13th_edition","v6.6.4","v6.6.3","v6.6.2","v6.6.1","v6.6","v6.5.5","v6.5.4","v6.5.3","v6.5.2","v6.5.1","v6.5","v6.4.5","v6.4.4","v6.4.3","v6.4.2","v6.4.1","v6.4","v6.3.3","v6.3.2","v6.3.1","v6.3","v6.2.3_-_End_of_World_Edition","v6.2.2","v6.2.1","v6.2","v6.1.8","v6.1.7","v6.1.6","v6.1.5","v6.1.4","v6.1.3","v6.1.2","v6.1.1","v6.1","v6","v5.9.8","v5.9.7","v5.9.6.2","v5.9.6.1","v5.9.6","v5.9.5","v5.9.4","v5.9.3","v5.9.2","v5.9.1","v5.9","v5.8.7","v5.8.6","v5.8.5","v5.8.4","v5.8.3","v5.8.2","v5.8.1","v5.8","v5.7","v5.6.8","v5.6.7","v5.6.6","v5.6.5","v5.6.4","v5.6.3","v5.6.2","v5.6.1","v5.6","v5.5.1","v5.5","v5.4.5","v5.4.4","v5.4.3","v5.4.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48778.json","vanir_signatures_modified":"2026-08-12T16:25:29Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614","target":{"file":"PowerEditor/src/WinControls/FileBrowser/fileBrowser.cpp"},"deprecated":false,"digest":{"line_hashes":["255843702943533162052822562669448870147","144303542474191456359675786964917941594","176518038442311060304119020823571622587","335534184444528924988113252730039638803","172348187629356992754530251344034023851","169439940570265881714889666568925956111","42993313022431523174938375848991795382","176977637630608724214357553495415646348","28585317047481199772613180682645127621","44416698591747841536019793792240578406","125261097626948597346511886007588838085","232691229264113619248130254463918680461","168286781640882379597710001596462508651","176267713712148653690205052540341794143","284218290897837362960519902706802532574","100484001876799786742075553784489374595","92366902690213444316553573087649833709","273920440173799401833091192616770718205","6087091128726032244366302303781221283","242709083424408389732790141010086168630","185010684148894369451847070219200920257","326364397922559315961070092353118329777","233304515239769291909183840725857768191","102810562262335505279519781121753743925"],"threshold":0.9},"id":"CVE-2026-48778-12598bcd"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614","target":{"file":"PowerEditor/src/Notepad_plus.cpp","function":"Notepad_plus::checkDocState"},"deprecated":false,"digest":{"function_hash":"279420604499050548160321103830044108333","length":3166},"id":"CVE-2026-48778-422d6065"},{"deprecated":false,"digest":{"function_hash":"43607104269573927827600832733266841933","length":34456},"id":"CVE-2026-48778-783fc642","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614","target":{"file":"PowerEditor/src/Parameters.cpp","function":"NppParameters::feedGUIParameters"}},{"id":"CVE-2026-48778-78bc409b","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614","target":{"function":"Notepad_plus::notify","file":"PowerEditor/src/NppNotification.cpp"},"deprecated":false,"digest":{"function_hash":"63324965148463137471281371312978690260","length":32930}},{"source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614","target":{"function":"NppParameters::createXmlTreeFromGUIParams","file":"PowerEditor/src/Parameters.cpp"},"deprecated":false,"digest":{"function_hash":"112486843452935489408814958001212969092","length":23411},"id":"CVE-2026-48778-78d03b9b","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"87271981076174897286977297453387561257","length":107382},"id":"CVE-2026-48778-88daefe8","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614","target":{"file":"PowerEditor/src/NppCommands.cpp","function":"Notepad_plus::command"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614","target":{"file":"PowerEditor/src/Parameters.cpp"},"deprecated":false,"digest":{"line_hashes":["282352191854347708547281380746248882760","288921997509041343024713439550816088153","279588123858745919469934241568706347157","283930580948694904998302502338496735710","309076803299162229527126389506982122835","271268127124866954553490611286648858031","144208066462221632709255722563837268506","56852239145898973188168979917493932903","303213127586338108761162219204802441632","283823191272735417064780945648739989552","76633056629639767372306803797940368624","288550347358593388960840861682851409323","215989511060407516135586332575479423370","207041561716749825051728741432813090632","115285960031530488435456167755773737497","25269812952101932425217732964592634751","143376927246674748025050606517314398500","58932521541695240783545474266049839430","4584005253421837847735850391299744284","133525126415010861767503672279751016148","108233393394346401703699388280059233854","218826412477604576912881659617219840694","133505076685785459100592914717471534552","205635668141445235738334457312291094835","32492207193574257172773974276186900137","174624568109557960832897569063104445493"],"threshold":0.9},"id":"CVE-2026-48778-96d86019"},{"digest":{"function_hash":"66426694836895364657056723225008233295","length":3371},"id":"CVE-2026-48778-c280d14b","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614","target":{"file":"PowerEditor/src/WinControls/FileBrowser/fileBrowser.cpp","function":"FileBrowser::popupMenuCmd"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"318925269122123989401331831997821305102","length":3525},"id":"CVE-2026-48778-c61b236e","signature_type":"Function","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614","target":{"file":"PowerEditor/src/WinControls/FileBrowser/fileBrowser.cpp","function":"FileBrowser::initPopupMenus"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614","target":{"file":"PowerEditor/src/NppNotification.cpp"},"deprecated":false,"digest":{"line_hashes":["226910095778786956096264912696819696874","31828160031156081201828472246132213768","11613273851825106210961971492790638793","17020532298737589155559898984949119416","261510005210722323727539954942584923326","461062546501921750512572907406759627","131118736764200584180836600414337764161","175940765074182517000991115227937049820"],"threshold":0.9},"id":"CVE-2026-48778-d2c01082"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["159821191204308042385163136082421713446","57662782448982694498845824031833267529","39302789924277115687855442705992631341","179281636706210601891069698224510532648","218810638335913816148641881156674430920","33391790208779244417827627980159817015","84559633307319404363229101829200354280"]},"id":"CVE-2026-48778-e62dd84a","signature_type":"Line","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614","target":{"file":"PowerEditor/src/NppCommands.cpp"}},{"id":"CVE-2026-48778-efc766cf","signature_type":"Line","signature_version":"v1","source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614","target":{"file":"PowerEditor/src/Parameters.h"},"deprecated":false,"digest":{"line_hashes":["54940300060031876810190721312158442507","95360130453493856899052672425574546001","255440408429619437757541240096128298704","81423966128252114705831388475218509344","51852320012302861095066896712052492546","69203870778451100504223158718265677757","96549694264451516433166728589144888069","231261010374784931433009048374148260680","220391311238879382979559909269475993511"],"threshold":0.9}},{"source":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614","target":{"file":"PowerEditor/src/Notepad_plus.cpp"},"deprecated":false,"digest":{"line_hashes":["285385969618049054612449241837443370996","82786991223535896801089636203742895460","280099708527575425435486100290171881255","265674737773574096632510907488319129567"],"threshold":0.9},"id":"CVE-2026-48778-fee8f855","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}