CVE-2026-77605 Notepad++ “Run by system” executes .txt.cmd when user selected .txt (target confusion → command execution)

🗓️ 22 Sep 2026 17:13:21Reported by GitHub_MType

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script who...

Reporter	Title	Published	Views	Family All 5
Circl	CVE-2026-77605	23 Sep 202616:45	–	circl
CVE	CVE-2026-77605	22 Sep 202617:13	–	cve
EUVD	EUVD-2026-84573	22 Sep 202617:13	–	euvd
NVD	CVE-2026-77605	22 Sep 202618:17	–	nvd
Rapid7 Vulnerability Database (full)	NotepadPlusPlus: CVE-2026-77605: Improper Input Validation	22 Sep 202600:00	–	rapid7

[
  {
    "vendor": "notepad-plus-plus",
    "product": "notepad-plus-plus",
    "versions": [
      {
        "version": "< 8.9.8",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/notepad-plus-plus/notepad-plus-plus/commit/00fa5df0da1d4f6b334317aa979db13ac77ee24d
github	www.github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8
notepad-plus-plus	www.notepad-plus-plus.org/news/v898-released
github	www.github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-w5xq-frjg-w4cw

22 Sep 2026 17:13Current

CVSS 3.17.8

EPSS0.00186

CVE-2026-77605 Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)

CVE-2026-77605 Notepad++ “Run by system” executes .txt.cmd when user selected .txt (target confusion → command execution)