PT-2026-38552 · Dail8859 · Notepadnext

Published 2026-05-07 · Updated 2026-05-07 · CVE-2026-42214

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-42214

Affected Products

Notepadnext

References · 4

• 🔥 https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42214 · Security Note
• https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc · Note
• https://github.com/dail8859/NotepadNext/releases/tag/v0.14 · Note