Notepad++ versions up to and including 8.9.6 contain a vulnerability that lets an attacker achieve arbitrary code execution by modifying the editor’s configuration file. Tracked as CVE-2026-48778, the flaw was discovered by Kavin Jindal of Avyukt Security.
The issue centers on the commandLineInterpreter setting in Notepad++’s config.xml file. When a user triggers “Open Containing Folder in cmd,” Notepad++ reads this value and passes it to ShellExecute. If an attacker with write access to the user’s %APPDATA%\Notepad++\ directory replaces the interpreter path with an arbitrary executable, that program launches instead of cmd.
The attack scenario requires the attacker to have write access to the user’s AppData folder — which could happen through another vulnerability, a malicious script, or shared access. Once the config is modified, the next time the user uses the “Open Containing Folder in cmd” feature, the attacker’s chosen executable runs with the user’s privileges.
The GitHub advisory includes a proof-of-concept that injects calc.exe as a demonstration. Notepad++ users should avoid opening untrusted files and watch for unexpected behavior. A patch is expected in the next release.
