Loading story…
Notepad++ released version 8.9.7 with fixes for five security vulnerabilities, including a critical installer-based flaw that could allow PowerShell command injection and arbitrary code execution. Reported issues also include a stack buffer overflow, a Zip Slip path traversal vulnerability in the WinGUp updater, a session.xml path validation bypass, and a shortcuts.xml macro HMAC integrity bypass. The weaknesses could be exploited through tampered installers, malicious local configuration files, or abuse of update extraction to overwrite files, corrupt memory, bypass protections, or fully compromise a system.
The Canadian Centre for Cyber Security issued advisory AV26-703, warning that vulnerabilities affect Notepad++ versions prior to 9.7 and urging users and administrators to review the vendor guidance and apply updates. The notice points to the Notepad++ security advisory and release resources for remediation, while reporting indicates users should update manually rather than wait for the staged auto-updater rollout.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Notepad++ version 8.9.7 was released with patches for five vulnerabilities, including a critical installer-based PowerShell command injection flaw. The release also fixed a stack buffer overflow, a Zip Slip issue in the WinGUp updater, a session.xml path validation bypass, and a shortcuts.xml macro HMAC integrity bypass.
On July 14, 2026, Notepad++ published a security advisory addressing vulnerabilities affecting versions prior to 9.7. The advisory was later highlighted by the Canadian Centre for Cyber Security, which urged users and administrators to apply the necessary updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcecommunity.notepad-plus-plus.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Notepad++ released **v8.9.6.1** to fix three vulnerabilities affecting versions up to **8.9.6**, including two arbitrary code execution flaws tracked as `CVE-2026-48778` and `CVE-2026-48800`, and a denial-of-service crash bug tracked as `CVE-2026-48770`. The most serious issue involves unsafe handling of the `commandLineInterpreter` value in `config.xml`, which can be passed to `ShellExecute()` when a user invokes the **Open Containing Folder in cmd** feature, allowing attacker-controlled programs to run instead of the intended interpreter. A separate flaw in `shortcuts.xml` also enables arbitrary code execution, while malformed XML structures can trigger application crashes. Advisories and follow-on reporting said exploitation could occur if an attacker can tamper with `%APPDATA%\Notepad++\config.xml`, abuse the `-settingsDir` parameter through malicious `.lnk` files, poison cloud-synced settings, or socially engineer users into opening archives that place malicious configuration files in writable paths. A published proof of concept demonstrated the `config.xml` issue by launching `calc.exe`. The Canadian Centre for Cyber Security urged users and administrators to apply the update, while researchers recommended restricting write access to configuration directories, validating executable paths, and monitoring shared or synced settings locations in enterprise environments.
Jun 29, 2026
Notepad++ released fixes for two arbitrary code execution issues that allowed attacker-controlled configuration data to trigger program execution through trusted application features. One flaw, tracked as **GHSA-3x3f-3j39-pj3v** and affecting versions through **v8.9.6**, let malicious content placed in `shortcuts.xml` create legitimate-looking entries under the **Run** menu; when clicked, those entries were passed to `ShellExecute`, enabling execution of arbitrary programs and potential persistence. The advisory said the attack could be carried out by modifying `shortcuts.xml` directly or by steering Notepad++ to a malicious settings directory via a crafted `.lnk` shortcut. The project also fixed a separate issue in `config.xml`, tracked as **CVE-2026-48778** and **GHSA-7hm3-wp5q-ccv9**, by removing the configurable `commandLineInterpreter` setting that could be abused for unsafe command execution and replacing it with trusted system paths for launching `cmd` and PowerShell. Additional hardening for the `shortcuts.xml` path was shipped in the **v8.9.6.x** line, including absolute-path enforcement, `SearchPathW` resolution for bare executable names, blocking invalid targets, and warning dialogs for insecure `http` URLs and risky executable types from untrusted locations; the changes also added a new **Open Containing Folder in PowerShell** feature and related File Browser menu entries.
Jun 29, 2026
Notepad++ disclosed a **critical** vulnerability affecting version **8.9.3 and earlier**, and the Canadian Centre for Cyber Security urged users to apply the vendor’s update. The issue is tracked as **`CVE-2026-3008`** and has been described as a **string injection** flaw that can let an attacker obtain memory address information or crash the application; the recommended remediation is to upgrade to **Notepad++ 8.9.4**. Public CVE records indicate the flaw is remotely reachable with **low attack complexity**, requires **no privileges** and **no user interaction**, and carries high potential impact across confidentiality, integrity, and availability. References tied to the disclosure include Notepad++ release materials, issue-tracking resources, and a Singapore CSA advisory, underscoring broad public disclosure and the need for rapid patching on systems where Notepad++ is installed.
Jun 29, 2026