Exploitation Summary
EIP tracks 5 public exploits for CVE-2026-48778. PoCs published by Kavin Jindal, Unclecheng-li, XK3NF4.
AI-analyzed exploit summary This exploit demonstrates arbitrary code execution in Notepad++ <= 8.9.6 by injecting a malicious executable path into the config.xml file. The payload modifies the commandLineInterpreter setting, causing Notepad++ to execute calc.exe instead of cmd when 'Open Containing Folder in cmd' is triggered.
Description
Notepad++ 8.9.6 - Arbitrary Code Execution
Exploits (5)
This exploit demonstrates arbitrary code execution in Notepad++ <= 8.9.6 by injecting a malicious executable path into the config.xml file. The payload modifies the commandLineInterpreter setting, causing Notepad++ to execute calc.exe instead of cmd when 'Open Containing Folder in cmd' is triggered.
This repository contains a functional proof-of-concept for CVE-2026-48778, demonstrating arbitrary code execution in Notepad++ via a malicious config.xml file. The exploit leverages a lack of validation in the commandLineInterpreter field, allowing an attacker to replace the default cmd.exe with any executable.
This repository contains a functional exploit for CVE-2026-48778, which leverages a vulnerability in Notepad++'s config.xml handling to achieve remote code execution (RCE). The exploit modifies the 'commandLineInterpreter' setting in the config.xml file to execute arbitrary commands when triggered via specific user actions in Notepad++.
This repository contains a functional exploit for CVE-2026-48778, which leverages a vulnerability in Notepad++'s config.xml handling to achieve remote code execution (RCE). The exploit modifies the 'commandLineInterpreter' setting in the config.xml file to execute arbitrary commands when triggered via specific user actions in Notepad++.
This repository contains a functional Python script that exploits CVE-2026-48778 in Notepad++ by injecting a malicious payload into the config.xml file, leading to arbitrary code execution when a specific menu option is triggered.