CVE-2026-48778

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 creates a Command object with this value and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. This vulnerability is fixed in 8.9.6.1.

• CWE-78

• https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614Patch
• https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9Exploit, Patch, Vendor Advisory
• https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9Exploit, Patch, Vendor Advisory

Published

Jun 26, 2026

Last Modified

Jun 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48772ProxySQL is a proxy for MySQL and its forks, as well as Post…10
• CVE-2026-48773ProxySQL is a proxy for MySQL and its forks, as well as Post…9.8
• CVE-2026-48774ProxySQL is a proxy for MySQL and its forks, as well as Post…7.5
• CVE-2026-48775LangGraph SQLite Checkpoint is an implementation of LangGrap…6.8
• CVE-2026-48776LangGraph Python SDK is used to connect to running LangGraph…9.1
• CVE-2026-48777FileBrowser Quantum is a free, self-hosted, web-based file m…9.3
• CVE-2026-48779ws is an open source WebSocket client and server for Node.js…7.5
• CVE-2026-4878A flaw was found in libcap. A local unprivileged user can ex…7
• CVE-2026-48780Forem is open source software for building communities. Prio…8.2
• CVE-2026-48781Postiz is an AI social media scheduling tool. In versions pr…9.9
• CVE-2026-48782Pydantic AI is a Python agent framework for building applica…6.8
• CVE-2026-48783Postiz is an AI social media scheduling tool. Versions prior…4.8