Arbitrary Command Execution in NotepadNext Prior to Version 0.14

CVE-2026-42214

What is CVE-2026-42214?

NotepadNext, a cross-platform reimplementation of Notepad++, has a vulnerability that allows attackers to execute arbitrary commands. In versions prior to 0.14, the function detectLanguageFromExtension() interpolates a file's extension into a Lua script without proper sanitization. This flaw permits attackers to create specially crafted filenames with malicious Lua code that executes upon file opening in NotepadNext. The vulnerability grants full access to Lua's os, io, and package libraries, which can be exploited for arbitrary command execution. The issue has been resolved in version 0.14.

References