Notepad++ Flaws Allow Command Execution Via XML Files
Recent vulnerabilities in Notepad++ enable arbitrary code execution on Windows through XML manipulation.
Two critical vulnerabilities in Notepad++ have been identified, allowing local attackers to execute arbitrary commands on Windows systems by altering XML configuration files. Both flaws, CVE-2026-48778 and CVE-2026-48800, hold a CVSS score of 7.8, marking them as high-severity risks. These vulnerabilities affect all versions of the text editor up to and including 8.9.6. Notepad++ promptly addressed the issues in version 8.9.6.1, as noted by the application's creator, Dun Ho.
The root of these vulnerabilities lies in a design flaw where user settings, such as command-line interpreter paths and user-defined commands, are stored in XML files within the user’s profile directory. Notepad++ reads these settings and executes them with no verification. This means anyone with write access to these XML files can dictate the commands executed by the software.
Of the two flaws, CVE-2026-48800 is considered more severe. It involves the shortcuts.xml file, which contains entries for user-defined Run menu commands. An attacker who can modify this file can introduce commands that execute arbitrary programs, masquerading as legitimate user-created shortcuts. This can enable persistent malicious activity, surviving even system reboots. Michele Piccinni, an Italian researcher, discovered this vulnerability.
The second flaw, CVE-2026-48778, involves the config.xml file, which stores the path to the Notepad++ command-line interpreter. An attacker can alter this path to execute any program instead of the intended Windows command prompt. Piccinni also reported this issue.
Both vulnerabilities require the attacker to have prior write access to the user's AppData directory or to deceive the user into running Notepad++ with a compromised settings folder. This could be achieved via local malware, malicious shortcuts, or other social engineering tactics.
A related issue, CVE-2026-48770, also patched in version 8.9.6.1, involves a bug that can crash Notepad++ through malformed inter-process messages. This flaw has a lower CVSS score of 5.0, as it does not lead to code execution.
The patched version of Notepad++ is available on the project's download page, offering both EXE and MSI installers. The introduction of an MSI installer in 2025 followed a period of heightened enterprise demand, especially after a Chinese state-sponsored group's infiltration of the editor's update infrastructure.
Security advisories recommend monitoring the AppData folder for unusual changes in shortcuts.xml and config.xml, as these vulnerabilities leave no trace in the installation directory or the Notepad++ binary itself.
