PT-2026-44400 · Notepad++ · Notepad++

Michele Piccinni · CVE-2026-48778 · Published 2026-05-26 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.6.1

Description An issue exists in the processing of the commandLineInterpreter parameter within the config.xml configuration file. The software fails to neutralize special elements, which allows an attacker to replace cmd.exe with malicious executables via unvalidated config.xml files, leading to arbitrary code execution on the victim's machine.

Recommendations Update to version 8.9.6.1.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-07493

CVE-2026-48778

GHSA-7HM3-WP5Q-CCV9

Affected Products

Notepad++

References · 34

• 🔥 https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48778.json · Exploit
• 🔥 https://exploit-db.com/exploits/52606 · Exploit
• https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614 · Patch
• https://osv.dev/vulnerability/CVE-2026-48778 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48778 · Security Note
• https://bdu.fstec.ru/vul/2026-07493 · Security Note
• https://t.me/CVEtracker/58145 · Telegram Post
• https://twitter.com/eyalestrin/status/2060702325489250487 · Twitter Post
• https://t.me/cveNotify/178490 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1trvshw/top_10_trending_cves_30052026 · Reddit Post
• https://twitter.com/mwbengtsson/status/2061752320531079345 · Twitter Post
• https://twitter.com/lyrie_ai/status/2063935671463452810 · Twitter Post
• https://acn.gov.it/portale/w/notepad-poc-pubblici-per-le-cve-2026-48800-cve-2026-48778-e-cve-2026-48770 · Note
• https://community.notepad-plus-plus.org/topic/27548/notepad-release-8.9.6.1 · Note