Michele Piccinni

**Name of the Vulnerable Software and Affected Versions** Notepad++ (affected versions not specified) **Description** A zero-click remote code execution (RCE) issue exists due to path traversal. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Notepad++ versions prior to 8.9.6.1 **Description** An issue exists in the processing of the `commandLineInterpreter` parameter within the `config.xml` configuration file. The software fails to neutralize special elements, which allows an attacker to replace `cmd.exe` with malicious executables via unvalidated `config.xml` files, leading to arbitrary code execution on the victim's machine. **Recommendations** Update to version 8.9.6.1.

**Name of the Vulnerable Software and Affected Versions** Notepad++ (affected versions not specified) **Description** Multiple issues exist in the software. The `config.xml` configuration file fails to neutralize special elements when processing the `commandLineInterpreter` parameter. Additionally, the `shortcuts.xml` configuration file does not properly neutralize special elements. Both of these issues could allow an attacker to execute arbitrary code. Furthermore, a memory out-of-bounds read in the inter-process communication mechanism could lead to a denial of service (DoS), which is a condition where the application becomes unavailable to users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.