Loading story…
Notepad++ released v8.9.6.1 to fix three vulnerabilities affecting versions up to 8.9.6, including two arbitrary code execution flaws tracked as CVE-2026-48778 and CVE-2026-48800, and a denial-of-service crash bug tracked as CVE-2026-48770. The most serious issue involves unsafe handling of the commandLineInterpreter value in config.xml, which can be passed to ShellExecute() when a user invokes the Open Containing Folder in cmd feature, allowing attacker-controlled programs to run instead of the intended interpreter. A separate flaw in shortcuts.xml also enables arbitrary code execution, while malformed XML structures can trigger application crashes.
Advisories and follow-on reporting said exploitation could occur if an attacker can tamper with %APPDATA%\Notepad++\config.xml, abuse the -settingsDir parameter through malicious .lnk files, poison cloud-synced settings, or socially engineer users into opening archives that place malicious configuration files in writable paths. A published proof of concept demonstrated the config.xml issue by launching calc.exe. The Canadian Centre for Cyber Security urged users and administrators to apply the update, while researchers recommended restricting write access to configuration directories, validating executable paths, and monitoring shared or synced settings locations in enterprise environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-01, public technical details and exploit code were disclosed for three Notepad++ flaws: CVE-2026-48800, CVE-2026-48778, and CVE-2026-48770. The disclosure included XML payloads and a PowerShell proof of concept, increasing exploitation risk for versions up to and including 8.9.6.
On 2026-05-28, the Canadian Centre for Cyber Security published advisory AV26-521 about the Notepad++ vulnerabilities. It urged users and administrators to review Notepad++'s release information and apply the necessary updates.
A GitHub security advisory published on 2026-05-26 documented GHSA-7hm3-wp5q-ccv9 / CVE-2026-48778, explaining that unsafe handling of the commandLineInterpreter value in config.xml could lead to arbitrary program execution. The advisory described attack vectors such as tampering with %APPDATA%\Notepad++\config.xml, abusing -settingsDir, cloud-sync poisoning, and social engineering, and included a proof of concept launching calc.exe.
On 2026-05-26, Notepad++ released version 8.9.6.1 and said it fixes three vulnerabilities affecting earlier versions. The patched issues were CVE-2026-48770, CVE-2026-48778, and CVE-2026-48800, including two arbitrary code execution flaws tied to config.xml and shortcuts.xml.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethecyberexpress.com
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcenotepad-plus-plus.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Notepad++ released fixes for two arbitrary code execution issues that allowed attacker-controlled configuration data to trigger program execution through trusted application features. One flaw, tracked as **GHSA-3x3f-3j39-pj3v** and affecting versions through **v8.9.6**, let malicious content placed in `shortcuts.xml` create legitimate-looking entries under the **Run** menu; when clicked, those entries were passed to `ShellExecute`, enabling execution of arbitrary programs and potential persistence. The advisory said the attack could be carried out by modifying `shortcuts.xml` directly or by steering Notepad++ to a malicious settings directory via a crafted `.lnk` shortcut. The project also fixed a separate issue in `config.xml`, tracked as **CVE-2026-48778** and **GHSA-7hm3-wp5q-ccv9**, by removing the configurable `commandLineInterpreter` setting that could be abused for unsafe command execution and replacing it with trusted system paths for launching `cmd` and PowerShell. Additional hardening for the `shortcuts.xml` path was shipped in the **v8.9.6.x** line, including absolute-path enforcement, `SearchPathW` resolution for bare executable names, blocking invalid targets, and warning dialogs for insecure `http` URLs and risky executable types from untrusted locations; the changes also added a new **Open Containing Folder in PowerShell** feature and related File Browser menu entries.
Jun 29, 2026
Notepad++ released version **8.9.7** with fixes for five security vulnerabilities, including a critical installer-based flaw that could allow **PowerShell command injection** and arbitrary code execution. Reported issues also include a stack buffer overflow, a **Zip Slip** path traversal vulnerability in the `WinGUp` updater, a `session.xml` path validation bypass, and a `shortcuts.xml` macro HMAC integrity bypass. The weaknesses could be exploited through tampered installers, malicious local configuration files, or abuse of update extraction to overwrite files, corrupt memory, bypass protections, or fully compromise a system. The Canadian Centre for Cyber Security issued advisory **AV26-703**, warning that vulnerabilities affect **Notepad++ versions prior to 9.7** and urging users and administrators to review the vendor guidance and apply updates. The notice points to the Notepad++ security advisory and release resources for remediation, while reporting indicates users should update manually rather than wait for the staged auto-updater rollout.
Jul 17, 2026
Notepad++ disclosed a **critical** vulnerability affecting version **8.9.3 and earlier**, and the Canadian Centre for Cyber Security urged users to apply the vendor’s update. The issue is tracked as **`CVE-2026-3008`** and has been described as a **string injection** flaw that can let an attacker obtain memory address information or crash the application; the recommended remediation is to upgrade to **Notepad++ 8.9.4**. Public CVE records indicate the flaw is remotely reachable with **low attack complexity**, requires **no privileges** and **no user interaction**, and carries high potential impact across confidentiality, integrity, and availability. References tied to the disclosure include Notepad++ release materials, issue-tracking resources, and a Singapore CSA advisory, underscoring broad public disclosure and the need for rapid patching on systems where Notepad++ is installed.
Jun 29, 2026