Exploitation Summary
EIP tracks 5 public exploits for CVE-2026-48778. PoCs published by Kavin Jindal, Unclecheng-li, XK3NF4.
AI-analyzed exploit summary This exploit demonstrates arbitrary code execution in Notepad++ <= 8.9.6 by injecting a malicious executable path into the config.xml file. The payload modifies the commandLineInterpreter setting, causing Notepad++ to execute calc.exe instead of cmd when 'Open Containing Folder in cmd' is triggered.
Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 creates a Command object with this value and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. This vulnerability is fixed in 8.9.6.1.
Exploits (5)
This exploit demonstrates arbitrary code execution in Notepad++ <= 8.9.6 by injecting a malicious executable path into the config.xml file. The payload modifies the commandLineInterpreter setting, causing Notepad++ to execute calc.exe instead of cmd when 'Open Containing Folder in cmd' is triggered.
This repository contains a functional proof-of-concept for CVE-2026-48778, demonstrating arbitrary code execution in Notepad++ via a malicious config.xml file. The exploit leverages a lack of validation in the commandLineInterpreter field, allowing an attacker to replace the default cmd.exe with any executable.
This repository contains a functional exploit for CVE-2026-48778, which leverages a vulnerability in Notepad++'s config.xml handling to achieve remote code execution (RCE). The exploit modifies the 'commandLineInterpreter' setting in the config.xml file to execute arbitrary commands when triggered via specific user actions in Notepad++.
This repository contains a functional exploit for CVE-2026-48778, which leverages a vulnerability in Notepad++'s config.xml handling to achieve remote code execution (RCE). The exploit modifies the 'commandLineInterpreter' setting in the config.xml file to execute arbitrary commands when triggered via specific user actions in Notepad++.
This repository contains a functional Python script that exploits CVE-2026-48778 in Notepad++ by injecting a malicious payload into the config.xml file, leading to arbitrary code execution when a specific menu option is triggered.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H