Loading story…
Notepad++ released fixes for two arbitrary code execution issues that allowed attacker-controlled configuration data to trigger program execution through trusted application features. One flaw, tracked as GHSA-3x3f-3j39-pj3v and affecting versions through v8.9.6, let malicious content placed in shortcuts.xml create legitimate-looking entries under the Run menu; when clicked, those entries were passed to ShellExecute, enabling execution of arbitrary programs and potential persistence. The advisory said the attack could be carried out by modifying shortcuts.xml directly or by steering Notepad++ to a malicious settings directory via a crafted .lnk shortcut.
The project also fixed a separate issue in config.xml, tracked as CVE-2026-48778 and GHSA-7hm3-wp5q-ccv9, by removing the configurable commandLineInterpreter setting that could be abused for unsafe command execution and replacing it with trusted system paths for launching cmd and PowerShell. Additional hardening for the shortcuts.xml path was shipped in the v8.9.6.x line, including absolute-path enforcement, SearchPathW resolution for bare executable names, blocking invalid targets, and warning dialogs for insecure http URLs and risky executable types from untrusted locations; the changes also added a new Open Containing Folder in PowerShell feature and related File Browser menu entries.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On May 27, 2026, a GitHub security advisory disclosed GHSA-3x3f-3j39-pj3v, describing an arbitrary code execution issue in Notepad++ versions up to and including v8.9.6. The advisory said the flaw was patched in v8.9.6.1 and explained that attacker-controlled shortcuts.xml entries could create legitimate-looking Run menu items that execute arbitrary programs.
On May 26, 2026, Notepad++ committed a fix for an arbitrary code execution issue involving shortcuts.xml and Run menu commands. The patch added multiple validation checks and five new warning or error dialogs to reduce unsafe command execution risks.
On May 25, 2026, Notepad++ committed a fix for an arbitrary code execution vulnerability tied to the configurable "commandLineInterpreter" setting in config.xml. The change removed the unsafe setting and replaced it with trusted system paths for launching cmd and PowerShell, with the fix associated with the v8.9.6.4 release line.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Notepad++ released **v8.9.6.1** to fix three vulnerabilities affecting versions up to **8.9.6**, including two arbitrary code execution flaws tracked as `CVE-2026-48778` and `CVE-2026-48800`, and a denial-of-service crash bug tracked as `CVE-2026-48770`. The most serious issue involves unsafe handling of the `commandLineInterpreter` value in `config.xml`, which can be passed to `ShellExecute()` when a user invokes the **Open Containing Folder in cmd** feature, allowing attacker-controlled programs to run instead of the intended interpreter. A separate flaw in `shortcuts.xml` also enables arbitrary code execution, while malformed XML structures can trigger application crashes. Advisories and follow-on reporting said exploitation could occur if an attacker can tamper with `%APPDATA%\Notepad++\config.xml`, abuse the `-settingsDir` parameter through malicious `.lnk` files, poison cloud-synced settings, or socially engineer users into opening archives that place malicious configuration files in writable paths. A published proof of concept demonstrated the `config.xml` issue by launching `calc.exe`. The Canadian Centre for Cyber Security urged users and administrators to apply the update, while researchers recommended restricting write access to configuration directories, validating executable paths, and monitoring shared or synced settings locations in enterprise environments.
Jun 29, 2026
Notepad++ released version **8.9.7** with fixes for five security vulnerabilities, including a critical installer-based flaw that could allow **PowerShell command injection** and arbitrary code execution. Reported issues also include a stack buffer overflow, a **Zip Slip** path traversal vulnerability in the `WinGUp` updater, a `session.xml` path validation bypass, and a `shortcuts.xml` macro HMAC integrity bypass. The weaknesses could be exploited through tampered installers, malicious local configuration files, or abuse of update extraction to overwrite files, corrupt memory, bypass protections, or fully compromise a system. The Canadian Centre for Cyber Security issued advisory **AV26-703**, warning that vulnerabilities affect **Notepad++ versions prior to 9.7** and urging users and administrators to review the vendor guidance and apply updates. The notice points to the Notepad++ security advisory and release resources for remediation, while reporting indicates users should update manually rather than wait for the staged auto-updater rollout.
Jul 17, 2026
Notepad++ released **v8.9.2** to harden its update process after a state-linked intrusion enabled attackers to **hijack update traffic** and selectively deliver malware to targeted users. The new “**double-lock**” design adds cryptographic verification of the **signed XML** update metadata returned by `notepad-plus-plus[.]org` (via **XMLDSig**) and complements earlier protections (introduced in **v8.8.9+**) that verify the **signed installer** downloaded from GitHub. Additional security changes to the *WinGUp* auto-updater include removing `libcurl.dll` to reduce DLL side-loading risk, removing insecure cURL SSL options (`CURLSSLOPT_ALLOW_BEAST`, `CURLSSLOPT_NO_REVOKE`), and restricting plugin-management execution to binaries signed with the same certificate as WinGUp. Reporting attributes the compromise to a China-linked actor (including **Lotus Blossom**) that abused a **shared hosting provider-level breach** to intercept and redirect update requests between **June and December 2025**, with selective victim targeting spanning government, telecom, and critical infrastructure—primarily in Southeast Asia but also affecting other regions. The campaign leveraged weaknesses in older WinGUp verification to deliver a malicious **NSIS** installer (`update.exe`) and execute follow-on payloads; described chains include a Lua script injection path delivering **Cobalt Strike** and another using **DLL sideloading** (including abuse of a legitimate Bitdefender component `BluetoothService.exe` to load a malicious `log.dll`) to deploy the **Chrysalis** backdoor. Notepad++ also fixed **CVE-2026-25926** (CVSS 7.3), an **unsafe search path** issue that could allow arbitrary code execution by launching Windows Explorer without an absolute path, potentially enabling execution of a malicious `explorer.exe` if the working directory is attacker-controlled.
Jun 29, 2026