CVE-2026-48778

What it actually does

This is a local command injection / arbitrary program execution flaw in Notepad++ before 8.9.6.1. Notepad++ reads the <GUIConfig name="commandLineInterpreter"> value from config.xml and stores it as the command-line interpreter path without validation, whitelisting, or signature verification. When a user selects File → Open Containing Folder → cmd, Notepad++ passes that attacker-controlled value to ShellExecute as the executable path. If an attacker can modify or plant the user's Notepad++ configuration file, the attacker can cause Notepad++ to launch an arbitrary executable or script with the privileges of the interactive user.

Why it matters to the business

Successful exploitation can turn a routine editor action into execution of attacker-controlled code on a workstation, leading to credential theft, source-code theft, malware installation, lateral movement, or ransomware staging depending on the user's privileges and endpoint controls. The flaw requires user interaction and local or profile-level configuration manipulation, but public exploit information is available, so organizations using Notepad++ should prioritize upgrading managed endpoints, especially developer workstations and systems that handle sensitive files.

How an attack unfolds

An attacker first needs a way to influence the victim's Notepad++ configuration, such as convincing the user to run a malicious portable Notepad++ bundle, replacing or modifying config.xml in the user's Notepad++ profile, abusing write access to a shared or synced configuration location, or using another initial foothold to edit the file. The attacker sets the commandLineInterpreter GUIConfig value to a malicious executable, script interpreter, or LOLBin invocation. Later, when the user uses Notepad++ and selects the feature that opens the containing folder in cmd, Notepad++ trusts the stored configuration value and calls ShellExecute with the attacker-supplied path. The payload then runs as the logged-in user, allowing follow-on actions such as downloading tools, executing PowerShell, establishing persistence, collecting files or credentials, and moving laterally if the compromised user has access to additional systems.

How to fix it

Upgrade Notepad++ to version 8.9.6.1 or later on all systems. Remove or replace older portable copies, since portable installations may carry their own local config.xml outside standard software inventory paths. If immediate upgrade is not possible, mitigate by restricting write access to Notepad++ configuration files, blocking untrusted portable application execution, and using endpoint controls to prevent Notepad++ from spawning script interpreters or suspicious child processes such as powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, or unknown binaries. Review config.xml and reset the commandLineInterpreter value to a trusted Windows command interpreter path where applicable, such as C:\Windows\System32\cmd.exe. Use application control, EDR behavioral rules, and least-privilege workstation hardening to reduce impact.

How to confirm the fix worked

Confirm that installed Notepad++ versions are 8.9.6.1 or later, including both centrally installed and portable copies. Search common profile and portable installation locations for config.xml and inspect the <GUIConfig name="commandLineInterpreter"> entry; it should be absent, default, or point only to an expected trusted command interpreter. Validate endpoint telemetry by testing that Notepad++ does not launch unexpected executables when the Open Containing Folder → cmd feature is used. Confirm software inventory, vulnerability scanner results, package-management reports, and EDR application inventory all agree that pre-8.9.6.1 versions have been removed or upgraded.

Typical attack path

1. Identify a target that uses a vulnerable Notepad++ version before 8.9.6.1.
2. Gain the ability to modify or supply the target's Notepad++ config.xml, commonly through phishing, a trojanized portable application bundle, shared profile/configuration abuse, or an existing low-privileged foothold.
3. Insert or replace the <GUIConfig name="commandLineInterpreter"> value with an attacker-controlled executable or script path.
4. Wait for or induce the user to choose File → Open Containing Folder → cmd in Notepad++.
5. Notepad++ invokes ShellExecute using the malicious commandLineInterpreter value.
6. The attacker-controlled payload runs with the victim user's privileges.
7. The attacker performs post-exploitation activity such as credential access, data collection, persistence, command-and-control, or lateral movement.

How to detect it

Investigate endpoint telemetry, EDR process trees, file integrity data, and Windows event logs for evidence that Notepad++ launched unexpected programs. Key sources include Sysmon Event ID 1 for process creation, Sysmon Event ID 11 for file creation, Sysmon Event ID 15 for alternate data streams, Sysmon Event ID 22 for DNS activity, Windows Security Event ID 4688 for process creation, PowerShell Script Block logs Event ID 4104, PowerShell Module logs Event ID 4103, and EDR telemetry showing parent-child process relationships. Look for notepad++.exe spawning powershell.exe, pwsh.exe, cmd.exe with unusual arguments, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe, or executables from Downloads, Temp, AppData, Desktop, removable media, or network shares. Review %APPDATA%\Notepad++\config.xml and any portable Notepad++ config.xml files for commandLineInterpreter values that do not point to a trusted cmd.exe path. Check file modification timestamps for config.xml shortly before suspicious process execution. If suspicious execution is found, collect the referenced payload, command line, child processes, network connections, persistence artifacts, and any credential-access activity from the same user session.

• <GUIConfig name="commandLineInterpreter"
• %APPDATA%\Notepad++\config.xml
• AppData\Roaming\Notepad++\config.xml
• notepad++.exe
• notepad++.exe -> powershell.exe
• notepad++.exe -> pwsh.exe
• notepad++.exe -> cmd.exe
• notepad++.exe -> wscript.exe
• notepad++.exe -> cscript.exe
• notepad++.exe -> mshta.exe
• notepad++.exe -> rundll32.exe
• notepad++.exe -> regsvr32.exe
• notepad++.exe -> certutil.exe
• notepad++.exe -> bitsadmin.exe
• notepad++.exe -> curl.exe
• notepad++.exe -> wget.exe
• commandLineInterpreter="powershell.exe"
• commandLineInterpreter="pwsh.exe"
• commandLineInterpreter="wscript.exe"
• commandLineInterpreter="cscript.exe"
• commandLineInterpreter="mshta.exe"
• commandLineInterpreter="rundll32.exe"
• commandLineInterpreter="regsvr32.exe"
• commandLineInterpreter="\\
• commandLineInterpreter="%TEMP%
• commandLineInterpreter="%APPDATA%
• commandLineInterpreter="%LOCALAPPDATA%
• commandLineInterpreter="C:\Users\
• ParentImage=*\notepad++.exe Image=*\powershell.exe
• ParentImage=*\notepad++.exe Image=*\pwsh.exe
• ParentImage=*\notepad++.exe Image=*\wscript.exe
• ParentImage=*\notepad++.exe Image=*\cscript.exe
• ParentImage=*\notepad++.exe Image=*\mshta.exe
• ParentImage=*\notepad++.exe Image=*\rundll32.exe
• ParentImage=*\notepad++.exe Image=*\regsvr32.exe

What your security team should do

• Prioritize upgrading Notepad++ to 8.9.6.1 or later across managed endpoints, with emphasis on developer, administrator, and privileged-user workstations.
• Inventory and remove unmanaged or portable Notepad++ copies that may not be patched by standard software deployment tooling.
• Hunt for suspicious Notepad++ configuration entries, especially commandLineInterpreter values pointing to user-writable paths, script interpreters, network shares, temporary directories, or unsigned binaries.
• Create EDR/SIEM detections for notepad++.exe spawning suspicious child processes, including PowerShell, Windows Script Host, mshta, rundll32, regsvr32, cmd with encoded or download commands, and executables from user-writable directories.
• Restrict write permissions to application configuration locations where feasible and prevent standard users from modifying shared application bundles.
• Use application control or attack surface reduction rules to block script interpreters and LOLBins from being launched by Notepad++ unless explicitly required.
• Educate users not to run untrusted portable editor bundles or import configuration files from unknown sources.
• Perform retrospective log review for Notepad++ process-child activity and suspicious modifications to config.xml before closing the remediation effort.