Loading vulnerability…
CVE-2026-48800 is an arbitrary code execution vulnerability in Notepad++ affecting versions prior to 8.9.6.1. The flaw is in processing of the shortcuts.xml configuration file, specifically the text content of the <Command> tag inside <UserDefinedCommands>. According to the provided technical details, feedUserCmds() reads this value via NppXml::value(aNode) in Parameters.cpp:3658 and stores it in UserCommand._cmd without validation. When the user selects the corresponding entry from the Run menu, NppCommands.cpp:4264 creates a Command object from the attacker-controlled string and run() ultimately invokes ShellExecute in RunDlg.cpp:221 using that string as the executable path. Because the command is rendered as a normal Run menu item, a maliciously modified shortcuts.xml can cause Notepad++ to launch an attacker-chosen executable under the current user context.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python proof-of-concept for CVE-2026-48800 affecting Notepad++ on Windows. It contains two files: a README describing the issue and usage, and a single executable script, cve-2026-48800.py, which is the main exploit entry point. The exploit is not network-based and does not target a remote service; instead, it is a local file-manipulation exploit that abuses Notepad++'s handling of UserDefinedCommands in shortcuts.xml. The script reads the APPDATA environment variable, constructs the path to %APPDATA%\Notepad++\shortcuts.xml, verifies the file exists, reads it into memory, and inserts a crafted XML Command element immediately after the <UserDefinedCommands> tag. The injected command creates a new Run-menu item named 'Command Injection Demo' that points to calc.exe. After writing the modified XML back to disk, the script instructs the operator to open Notepad++ and click Run -> Command Injection Demo, which triggers execution under the current user context. The exploit's main capability is arbitrary code execution via persistent configuration injection, but the provided payload is a benign demonstration command (calc.exe). Because the payload is hardcoded and simple, this is best classified as OPERATIONAL rather than weaponized. The exploit requires local access and write permissions to the victim user's Notepad++ configuration directory, plus user interaction to trigger the malicious menu entry. No exploit framework is used, and there are no C2 or remote callback endpoints present.
This repository is a small standalone PoC collection for three local vulnerabilities affecting Notepad++ <= 8.9.6 on Windows. It contains 7 files total: a README, two XML payload samples, one PowerShell crash PoC, and three Python PoCs. The code is not part of a larger exploit framework. Repository structure and purpose: - README.md documents the three CVEs, prerequisites, trigger conditions, and usage examples. - poc_CVE-2026-48770.py and payloads/poc_CVE-2026-48770.ps1 implement the same local crash technique in Python and PowerShell. - poc_CVE-2026-48778.py generates or restores a malicious config.xml for command execution. - poc_CVE-2026-48800.py generates or restores a malicious shortcuts.xml for command execution. - payloads/config.xml and payloads/shortcuts.xml are ready-made drop-in XML payloads. Main exploit capabilities: 1. CVE-2026-48770: local denial-of-service/crash. The PoC locates the Notepad++ window and sends a crafted WM_COPYDATA message with dwData=3 and a non-NUL-terminated 8192-byte buffer, aiming to trigger an out-of-bounds read and crash the process. 2. CVE-2026-48778: local code execution via configuration injection. The script writes a malicious %APPDATA%\Notepad++\config.xml or a temporary config.xml for use with -settingsDir. It sets GUIConfig name="commandLineInterpreter" to an attacker-chosen executable. When the user selects File -> Open Containing Folder -> cmd, Notepad++ launches that executable. 3. CVE-2026-48800: local code execution via shortcuts injection. The script writes a malicious %APPDATA%\Notepad++\shortcuts.xml or a temporary shortcuts.xml for use with -settingsDir. It adds a UserDefinedCommands entry whose text is an attacker-chosen executable. After restart, the victim can trigger execution from the Run menu. Operational characteristics: - The RCE PoCs support direct overwrite and restore workflows, including automatic backup creation (.bak). - Both RCE PoCs also support a settingsdir mode that avoids modifying the real AppData directory by preparing a temporary settings directory and printing a launch command for notepad++.exe -settingsDir=<tmpdir>. - Payloads are basic and customizable through command-line arguments, making the repository more than a pure detection script but still a straightforward PoC/operational local exploit set. No external network infrastructure, C2, or remote endpoints are used. The exploit surface is entirely local: Windows messaging and local Notepad++ configuration files.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A code execution vulnerability in Notepad++ involving improper processing of shortcuts.xml, allowing attackers to inject a payload into the shortcut command tag and execute an attacker-chosen executable when the user clicks the compromised menu entry.
A Notepad++ arbitrary code execution vulnerability caused by improper handling of shortcuts.xml data.
A critical arbitrary code execution vulnerability in Notepad++ that follows a similar exploitation pattern to CVE-2026-48778, but targets shortcuts.xml.
An arbitrary code execution vulnerability in Notepad++ triggered via shortcuts.xml files.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.