Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-07 | 2 | Disclosure2 |
| 2026-05-08 | 1 | Disclosure1 |
| 2026-05-09 | 1 | Disclosure1 |
| 2026-05-10 | 1 | Disclosure1 |
| 2026-05-12 | 1 | Disclosure1 |
CVE-2026-42214 Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's ext… https://www.cve.org/CVERecord?id=CVE-2026-42214
Post summary
The post announces CVE-2026-42214 for Notepad Next, noting a flaw in the detectLanguageFromExtension() function before v0.14, but provides no PoC, exploit, or patch details.
CVE-2026-42214: NotepadNext Lua Injection Enables RCE https://thecybrdef.com/cve-2026-42214-notepadnext-lua-injection-rce/ #Cyberdailyupdate #Cybernews #Cybersecurity
Post summary
A new CVE (CVE-2026-42214) affecting NotepadNext has been disclosed, describing a Lua injection flaw that allows remote code execution; no PoC, exploit tool, or patch details are provided.
CVE-2026-42214: NotepadNext Lua Injection Enables RCE https://thecybrdef.com/cve-2026-42214-notepadnext-lua-injection-rce/ #Cyberdailyupdate #Cybernews #Cybersecurity
Post summary
The article announces a newly disclosed vulnerability in NotepadNext that allows Lua injection to achieve remote code execution, with no mention of existing patches, exploits, or active attacks.
CVE-2026-42214: NotepadNext Lua Injection Enables RCE https://thecybrdef.com/cve-2026-42214-notepadnext-lua-injection-rce/ #Cyberdailyupdate #Cybernews #Cybersecurity https://t.co/x86pUGqKrl
Post summary
The tweet announces CVE‑2026‑42214, noting it allows RCE via Lua injection in NotepadNext, but it provides no PoC, exploit code, or patch details.
CVE-2026-42214 Lua Code Injection in Notepad Next Prior to Version 0.14 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42214
Post summary
The post announces CVE‑2026‑42214 as a Lua code injection flaw affecting Notepad Next before version 0.14, without mentioning any PoC, exploit, or patch.
🚨*CVE* CVE-2026-42214 Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's ext… https://www.cve.org/CVERecord?id=CVE-2026-42214 ----- Traducción: CVE-2026-42214 Not… http://infoflow.cloud`
Post summary
A newly published CVE‑2026‑42214 details a flaw in Notepad Next’s language detection routine prior to v0.14.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dail8859 | notepad_next | - | - | - |