PT-2026-38552 · Unknown · Notepadnext

Dohyun4455 · Published 2026-05-07 · Updated 2026-05-12 · CVE-2026-42214

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Notepad Next versions prior to 0.14

Description The detectLanguageFromExtension() function interpolates a file extension directly into a Lua script without sanitization. An attacker can craft a filename with an extension containing Lua code that executes automatically when the file is opened. Since luaL openlibs() is called unconditionally, the injected code has access to the full os, io, and package libraries, allowing for arbitrary command execution.

Recommendations Update to version 0.14.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-42214

Affected Products

Notepadnext

References · 11

• 🔥 https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g · Exploit
• https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42214 · Security Note
• https://github.com/dail8859/NotepadNext/releases/tag/v0.14 · Note
• https://twitter.com/VigneshVic23698/status/2054071565231518198 · Twitter Post
• https://t.me/CVEtracker/53007 · Telegram Post
• https://twitter.com/infoflowcloud/status/2052479003827593474 · Twitter Post
• https://twitter.com/cybrsecpath/status/2053428547679903805 · Twitter Post
• https://twitter.com/CVEnew/status/2052477951061467343 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052543039671828861 · Twitter Post
• https://twitter.com/SelvaKtm2/status/2053146447537906144 · Twitter Post