CVE-2026-48778

CVE-2026-48778 POC Notepad++ 通过 config.xml 中的 commandLineInterpreter 实现 RCE 使用方法 .\CVE-2026-48778.exe calc.exe 演示 https://github.com/user-attachments/assets/79ec82c9-ab37-4923-b62d-325710095e86 漏洞摘要 软件包| 受影响版本| 已修复版本 ---|---|--- Notepad++| = v8.9.6| v8.9.6.1 参考 GHSA-7hm3-wp5q-ccv9...

EUVD-2026-39907

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag in config.xml is read by NppXml::value Parameters.cpp:6430 and stored in nppGUI.commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDMFILEOPENCMD File → Open...

CVE-2026-48778

Notepad++ prior to 8.9.6.1 is affected by an RCE in config.xml: the value is read without validation and passed to ShellExecute when triggering File → Open Containing Folder → cmd, enabling attacker-controlled executable paths. The issue stems from NppXml::value() storing the value in _nppGUI._c...