CVE-2026-48800 Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection
Attackers can execute arbitrary code by injecting malicious commands into the shortcuts.xml file, which are then executed when the user selects the corresponding menu item.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-48800?
CVE-2026-48800 is a high-severity command injection vulnerability in notepad-plus-plus, published on 26 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserCommand._cmd without any validation. When the user clicks the corresponding entry in the Run menu, NppCommands.cpp:4264 creates a Command object with string2wstring(ucmd.getCmd()) and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. The injected command appears as a normal menu item in the Run menu, making it a viable persistence mechanism. This vulnerability is fixed in 8.9.6.1.
Weakness: CWE-78
Which versions are affected by CVE-2026-48800?
It affects 1 product.
Products include Notepad-Plus-Plus Notepad\+\+.
How do I fix CVE-2026-48800?
No fix has been published for CVE-2026-48800 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-48800 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48800 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in notepad-plus-plus
- CVE-2025-15556 Notepad++ Download of Code Without Integrity Check
- CVE-2026-48778 Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter
- CVE-2026-52884 Notepad++: CVE-2026-48800 Bypass
- CVE-2023-47452 Privilege escalation in n/a
- CVE-2023-40031 Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convert
Sources
Also known as GHSA-3x3f-3j39-pj3v.