CVE-2026-48778

🗓️ 26 Jun 2026 20:21:17Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 137 Views🌐 WEB

Notepad++ before 8.9.6.1 allows code execution via config.xml commandLineInterpreter without validation.

Reporter	Title	Published	Views	Family All 15
GithubExploit	Notepad-8.9.6-PoC	28 May 202622:25	–	githubexploit
GithubExploit	Exploit for CVE-2026-48778	30 May 202617:49	–	githubexploit
ATTACKERKB	CVE-2026-48778	26 Jun 202620:21	–	attackerkb
BDU FSTEC	The vulnerability of the config.xml configuration file of the Notepad++ text editor allows a hacker to execute arbitrary code.	29 May 202600:00	–	bdu_fstec
Circl	CVE-2026-48778	28 May 202612:51	–	circl
CNNVD	Notepad++ security vulnerabilities	30 May 202600:00	–	cnnvd
Cvelist	CVE-2026-48778 Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter	26 Jun 202620:21	–	cvelist
Exploit DB	Notepad++ 8.9.6 - Arbitrary Code Execution	30 May 202600:00	–	exploitdb
EUVD	EUVD-2026-39907	26 Jun 202620:21	–	euvd
Tenable Nessus	Notepad++ < 8.9.6.1 Multiple Vulnerabilities	4 Jun 202600:00	–	nessus

NVD

Vulners

Node

notepad-plus-plus notepad++Range<8.9.6.1

[
  {
    "vendor": "notepad-plus-plus",
    "product": "notepad-plus-plus",
    "versions": [
      {
        "version": "< 8.9.6.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614
github	www.github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9

Parameter	Position	Path	Description	CWE
<GUIConfig name="commandLineInterpreter">calc.exe</GUIConfig>	path	%APPDATA%\Notepad++\config.xml	Notepad++ reads commandLineInterpreter from config.xml without validation and uses it to invoke ShellExecute, enabling arbitrary code execution via crafted config.xml.	CWE-78

29 Jun 2026 21:22Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.8

EPSS0.01314

SSVC

CWE-78