CVE-2026-48778: Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag in config.xml is read by NppXml::value() (Parameters.cpp

highpublic exploitCVSS 7.8CVE-2026-48778

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 creates a Command object with this value and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. This vulnerability is fixed in 8.9.6.1.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.8
Published: 2026-06-26
Last updated: 2026-06-29
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-48778

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-487781.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 67% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-48778	coverage & exploitation status	NVD · CVE.org

Recent advisories for Notepad++ is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-52885: Notepad++ is a free and open-source source code editor. Prior to 8.9.6.4, NppCommands.cpp chec…nvd · 2026-06-26
highCVE-2026-52884: Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() do…nvd · 2026-06-26
highCVE-2026-48800: Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag text content…nvd · 2026-06-26
mediumCVE-2026-48770: Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, a local process in t…nvd · 2026-06-26
highCVE-2026-46710: Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ cont…nvd · 2026-06-26
criticalexploitedCVE-2025-15556: Notepad++ Download of Code Without Integrity Check Vulnerabilitycisa-kev · 2026-02-12

CVE-2026-48778: Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag in config.xml is read by NppXml::value() (Parameters.cpp

Details

Exploitation outlook

Referenced CVEs

Recent advisories for Notepad++ is a

More from NVD Recent CVEs