Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserCommand._cmd without any validation. When the user clicks the corresponding entry in the Run menu, NppCommands.cpp:4264 creates a Command object with string2wstring(ucmd.getCmd()) and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. The injected command appears as a normal menu item in the Run menu, making it a viable persistence mechanism. This vulnerability is fixed in 8.9.6.1.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-28 | 2 | Patch1PoC1 |
| 2026-05-29 | 2 | Patch1PoC1 |
| 2026-05-30 | 2 | Disclosure1PoC1 |
| 2026-06-02 | 1 | Patch1 |
| 2026-06-04 | 1 | Patch1 |
| 2026-06-11 | 1 | Disclosure1 |
| 2026-06-27 | 3 | Disclosure2General1 |
🚨 اذا انت من الجيل القديم ولاتزال تستخدم Notepad++ حدّث البرنامج فوراً إلى الإصدار الأخير (v8.9.6.1). 📍 الثغرة الأولى: (CVE-2026-48770) 📍 الثغرة الثانية: (CVE-2026-48778) 📍 الثغرة الثالثة: (CVE-2026-48800) https://t.co/Ke5sL7bgAl
Post summary
The tweet alerts users of three Notepad++ CVEs and urges an update to v8.9.6.1, but provides no technical or exploit details.
GitHub - atiilla/Notepad-8.9.6-PoC: Proof-of-concept scripts for three vulnerabilities in Notepad++ <= 8.9.6, patched in v8.9.6.1 (2026-05-26) CVE-2026-48770 / CVE-2026-48778 / CVE-2026-48800 · GitHub - https://github.com/atiilla/Notepad-8.9.6-PoC
Post summary
A GitHub repo hosts Proof‑of‑Concept scripts for three Notepad++ CVEs, with the vulnerability patched in version 8.9.6.1.
Notepad++ <= 8.9.6 Multiple Vulnerabilities (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800) poc: https://github.com/intelseclab/poc-archive/tree/master/pocs/binary/2026-05-28_notepad-plus-plus-8-9-6-multi-cve https://t.co/Et7ZKIEN5v
Post summary
The tweet supplies GitHub links to proof‑of‑concept code for multiple CVEs in Notepad++ through version 8.9.6, providing no exploitation or patch information.
CVE-2026-48778 & CVE-2026-48800 | Notepad++ | CVSS 7.8 HIGH 🐛 Config file injection - fake Run menu entries execute attacker code and survive reboots ✅ Fixed: Notepad++ 8.9.6.1 (May 27) 🔗 https://notepad-plus-plus.org/news/v8961-released/ #CVE #Cybersecurity #InfoSec #PatchNow
Post summary
The message announces two critical configuration injection flaws in Notepad++ that permit attackers to run code via fake menu entries; the issue has been patched in version 8.9.6.1.
CVE-2026-48800 Command Injection in Notepad++ Versions Prior to 8.9.6.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48800
Post summary
The post discloses a command injection vulnerability in Notepad++ versions before 8.9.6.1, without mentioning a PoC, exploit, or patch.
Se han revelado vulnerabilidades críticas (CVE-2026-48778 y CVE-2026-48800) en el popular editor Notepad++ que permiten la ejecución arbitraria de código (RCE). El fallo radica en la falta de validación de comandos dentro de los archivos de configuración (config.xml y shortcuts.xml). Los atacantes pueden explotar esto manipulando la sincronización en la nube, usando accesos directos maliciosos o mediante ingeniería social para ejecutar malware silenciosamente en el equipo de la víctima. Se recomienda actualizar urgentemente a la versión v8.9.6.1.
Post summary
Critical CVE‑2026‑48778 and CVE‑2026‑48800 in Notepad++ enable RCE via unvalidated commands in config files; users should immediately upgrade to v8.9.6.1.
CVE-2026-48800 Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppX… https://www.cve.org/CVERecord?id=CVE-2026-48800
Post summary
The post references CVE-2026-48800 affecting Notepad++ versions before 8.9.6.1, noting that the <Command> tag in shortcuts.xml is processed by NppX, but provides no PoC, exploit, or patch information.
🚨*CVE* CVE-2026-48800 Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag text content inside
Post summary
The tweet briefly names CVE-2026-48800 for Notepad++ with a version note but contains no additional vulnerability details, exploitation info, or remediation steps.
⚠️ Vulnerabilidades en productos Notepad++ ❗ CVE-2026-48800 ❗ CVE-2026-48778 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-notepad/ https://t.co/vGNRxPAhql
Post summary
The post announces two CVEs (CVE-2026-48800 and CVE-2026-48778) affecting Notepad++ and directs readers to a external CERT link for additional details.
Notepad++ の深刻な脆弱性 CVE-2026-48778／48800 が FIX：任意のコード実行の可能性 https://iototsecnews.jp/2026/05/28/critical-notepad-vulnerabilities-allow-attackers-to-execute-arbitrary-code/ Notepad++ における一連の脆弱性は、設定ファイルを読み込む際における入力値の検証不足に起因します。 脆弱性 CVE-2026-48778 では、設定ファイル内の特定の項目から値を読み込むプログラムの処理において、デジタル署名やホワイトリストによる安全性のチェックを一切行わずに保存してしまう不備がありました。同様の弱点は shortcuts.xml を対象とする CVE-2026-48800 にも存在し、改竄された設定ファイルを経由して、外部から指定された任意のプログラムが実行されてしまう状態を招いています。ご利用のチームは、ご注意ください。 #CVE202648770 #CVE202648778 #CVE202648800 #Notepad #Vulnerability
Post summary
The article discloses two Notepad++ vulnerabilities that enable arbitrary code execution through improperly validated configuration files and notes that a fix exists, but provides no exploit details or evidence of active exploitation.
Notepad++ vulnerabilities could enable arbitrary code execution on Windows systems (CVE-2026-48778 and CVE-2026-48800) http://dlvr.it/TSnfqg #patchmanagement
Post summary
New Notepad++ CVEs (2026‑48778 & 2026‑48800) are disclosed, potentially enabling arbitrary code execution on Windows systems.
csirt_it: ‼️ #Notepad++: disponibili #PoC per le CVE-2026-48800, CVE-2026-48778 e CVE-2026-48770 che interessano il noto editor di testo Rischio: 🔴 Tipologia: 🔸 Arbitrary Code Execution 🔸 Denial of Service 🔗 https://www.acn.gov.it/portale/w/notepad-poc-pubblici-per-le-cve-2026-48800-cve-2026-48778-e-cve-2026-48770 🔄 Aggiorname… https://t.co/siCgHZVjb5
Post summary
The tweet announces publicly available Proof of Concept code for three CVEs affecting Notepad++ and specifies the vulnerability types. It provides the PoC link and indicates the severity but does not mention patches or active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | notepad-plus-plus | notepad\+\+ | - | - | - |