Command Injection Vulnerability in Notepad++ Source Code Editor

CVE-2026-48800

What is CVE-2026-48800?

Notepad++, a widely used open-source code editor, is vulnerable to a command injection flaw where user-defined commands in shortcuts.xml can be exploited. The underlying issue arises because the tag content is processed without proper validation, allowing an attacker to inject malicious commands. When a user activates a menu item, the malicious command is executed, posing a significant security threat. This vulnerability has been addressed in Notepad++ version 8.9.6.1, which is crucial for users to update to mitigate potential risks.

References