Notepad++ Insecure Configuration in Command Line Interpreter

CVE-2026-48778

What is CVE-2026-48778?

Notepad++ is a widely-used open-source code editor that contains a security vulnerability in its handling of the tag within the config.xml file. In versions before 8.9.6.1, this configuration setting is read unsafely, allowing an attacker to input malicious commands that can be executed without proper validation or security checks. When a user initiates a file open command to access a folder, the application constructs a command using the unverified interpreter path, leading to potential arbitrary code execution. Users are advised to upgrade to version 8.9.6.1 to mitigate this risk.

References