798 matches found
CVE-2026-85288: Improper Neutralization of Special Elements used in an OS Command
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WMMACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback without the validation used by command. A tampered shortcuts.xml macro...
PT-2026-90780
My 4th official CVE is now assigned: π Notepad++ π Stack-based Buffer Overflow β οΈ High Severity π₯ CVE-2026-85279 A vulnerability in the plugin loading mechanism leading to potential arbitrary code execution. The comeback continues. πΏπ₯ CyberSecurity CVE BugBounty https://t.co/RiRptj80NP...
CVE-2026-71858
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++...
CVE-2026-57233
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...
CVE-2026-52886
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...
CVE-2026-54758
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $ and into the fixed-size wchart strMAXPATH stack buffer without bounding the m loop...
CVE-2026-57233 Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...
CVE-2026-57233
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...
CVE-2026-57233 Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...
CVE-2026-57233 Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...
CVE-2026-57233
In Notepad++ prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to the extraction destination without canonical containment validation, enabling a Zip Slip attack. A crafted entry like ../mimeTools/mimeTools.dll overwrites a sibling plugin DLL, achieving arbitrary code...
EUVD-2026-60375
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...
CVE-2026-52886
Notepad++ versions before 8.9.7 use std::wstring::starts_with to validate the backupFilePath attribute in session.xml during snapshot-mode restoration without path normalization, allowing .. sequences to read arbitrary user-readable files outside the backup directory into an editor tab. CVSS 5.1 ...
CVE-2026-52886
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...
CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...
CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...
EUVD-2026-60374
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...
CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...
CVE-2026-71858 Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++...
CVE-2026-71858
Notepad++ prior to 8.9.7 is vulnerable to an HMAC bypass in its macro system. Macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation normally applied to UserDefinedCommands, allowing invocation of Scintilla actions and the internal Open in Default Viewer command within...