PT-2026-44400 · Notepad++ · Notepad++

Published 2026-05-26 · Updated 2026-05-31 · CVE-2026-48778

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.6.1

Description A flaw in the config.xml configuration file occurs due to improper neutralization of special elements when processing the commandLineInterpreter parameter. This can allow an attacker to execute arbitrary code.

Recommendations Update to version 8.9.6.1.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-07493

CVE-2026-48778

Affected Products

Notepad++

References · 15

• 🔥 https://exploit-db.com/exploits/52606 · Exploit
• https://bdu.fstec.ru/vul/2026-07493 · Security Note
• https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9 · Note
• https://reddit.com/r/pwnhub/comments/1tr2lje/notepad_vulnerabilities_allow_arbitrary_code · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1tqx4fa/top_10_trending_cves_29052026 · Reddit Post
• https://twitter.com/piedpiper1616/status/2060544381585948861 · Twitter Post
• https://community.notepad-plus-plus.org/topic/27548/notepad-release-8.9.6.1 · Note
• https://twitter.com/the_yellow_fall/status/2060207200501407959 · Twitter Post
• https://t.me/CSIRT_italia/3563 · Telegram Post
• https://acn.gov.it/portale/w/notepad-poc-pubblici-per-le-cve-2026-48800-cve-2026-48778-e-cve-2026-48770 · Note
• https://reddit.com/r/CVEWatch/comments/1tsr525/top_10_trending_cves_31052026 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1trvshw/top_10_trending_cves_30052026 · Reddit Post
• https://twitter.com/eyalestrin/status/2060702325489250487 · Twitter Post
• https://notepad-plus-plus.org/news/v8961-released · Note
• https://t.me/ZerodayAlert/720 · Telegram Post