CVE-2026-48778

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-48778

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48778.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-48778

Aliases

GHSA-7hm3-wp5q-ccv9

Published

2026-06-26T20:21:17.254Z

Modified

2026-08-12T16:25:29.450385Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter

Details

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in nppGUI.commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDMFILEOPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 creates a Command object with this value and calls run(), which invokes ShellExecute (RunDlg.cpp:221) with the attacker-controlled string as the executable path. This vulnerability is fixed in 8.9.6.1.

Database specific

{
    "cwe_ids": [
        "CWE-78"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48778.json"
}

References

Affected packages

Git / github.com/notepad-plus-plus/notepad-plus-plus

Affected ranges

Type

GIT

Repo

https://github.com/notepad-plus-plus/notepad-plus-plus

Events

Introduced

Fixed

41dd976310db0ba551bb8a2810b60331df3a77f5

Fixed

24c7b5c63cece76dbc8c4f2607a27ebfe22fa614

Database specific

Show details

{
    "cpe": "cpe:2.3:a:notepad-plus-plus:notepad\\+\\+:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.9.6.1"
        }
    ]
}

Affected versions

7.*

7.2.2

7.3.1

v5.*

v5.4.2

v5.4.3

v5.4.4

v5.4.5

v5.5

v5.5.1

v5.6

v5.6.1

v5.6.2

v5.6.3

v5.6.4

v5.6.5

v5.6.6

v5.6.7

v5.6.8

v5.7

v5.8

v5.8.1

v5.8.2

v5.8.3

v5.8.4

v5.8.5

v5.8.6

v5.8.7

v5.9

v5.9.1

v5.9.2

v5.9.3

v5.9.4

v5.9.5

v5.9.6

v5.9.6.1

v5.9.6.2

v5.9.7

v5.9.8

Other

v6.*

v6.1

v6.1.1

v6.1.2

v6.1.3

v6.1.4

v6.1.5

v6.1.6

v6.1.7

v6.1.8

v6.2

v6.2.1

v6.2.2

v6.2.3_-_End_of_World_Edition

v6.3

v6.3.1

v6.3.2

v6.3.3

v6.4

v6.4.1

v6.4.2

v6.4.3

v6.4.4

v6.4.5

v6.5

v6.5.1

v6.5.2

v6.5.3

v6.5.4

v6.5.5

v6.6

v6.6.1

v6.6.2

v6.6.3

v6.6.4

v6.6.6_-_Friday_the_13th_edition

v6.6.7

v6.6.8

v6.6.9

v6.7

v6.7.1

v6.7.2

v6.7.3

v6.7.4_-_Je_suis_Charlie_edition

v6.7.5

v6.7.7

v6.7.8

v6.7.8.1

v6.7.8.2

v6.7.9

v6.7.9.1

v6.7.9.2

v6.8

v6.8.1

v6.8.2

v6.8.3

v6.8.4

v6.8.5

v6.8.6

v6.8.7

v6.8.8

v6.8.9

v6.9

v6.9.1

v6.9.2

v7.*

v7.1

v7.2

v7.2.1

v7.2.2

v7.3

v7.3.1

v7.3.2

v7.3.3

v7.4

v7.4.1

v7.4.2

v7.5.1

v7.5.2

v7.5.3

v7.5.4

v7.5.5

v7.5.6

v7.5.7

v7.5.8

v7.5.9

v7.6

v7.6.1

v7.6.2

v7.6.3

v7.6.4

v7.6.5

v7.6.6

v7.7

v7.7.1

v7.8

v7.8.1

v7.8.2

v7.8.3

v7.8.4

v7.8.5

v7.8.6

v7.8.7

v7.8.8

v7.8.9

v7.9

v7.9.1

v7.9.2

v7.9.3

v7.9.4

v7.9.5

v8.*

v8.1

v8.1.1

v8.1.2

v8.1.3

v8.1.4

v8.1.5

v8.1.6

v8.1.7

v8.1.8

v8.1.9

v8.1.9.1

v8.1.9.2

v8.1.9.3

v8.2

v8.2.1

v8.3

v8.3.1

v8.3.2

v8.3.3

v8.4

v8.4.1

v8.4.2

v8.4.3

v8.4.4

v8.4.5

v8.4.6

v8.4.7

v8.4.8

v8.4.9

v8.5

v8.5.1

v8.5.2

v8.5.3

v8.5.4

v8.5.5

v8.5.6

v8.5.7

v8.5.8

v8.6

v8.6.1

v8.6.2

v8.6.3

v8.6.4

v8.6.5

v8.6.6

v8.6.7

v8.6.8

v8.6.9

v8.7

v8.7.1

v8.7.2

v8.7.3

v8.7.4

v8.7.5

v8.7.6

v8.7.7

v8.7.8

v8.7.9

v8.8

v8.8.1

v8.8.2

v8.8.3

v8.8.4

v8.8.5

v8.8.6

v8.8.7

v8.8.8

v8.8.9

v8.9

v8.9.1

v8.9.2

v8.9.3

v8.9.4

v8.9.5

v8.9.6

Database specific

vanir_signatures_modified

"2026-08-12T16:25:29Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48778.json"

vanir_signatures

[
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "255843702943533162052822562669448870147",
                "144303542474191456359675786964917941594",
                "176518038442311060304119020823571622587",
                "335534184444528924988113252730039638803",
                "172348187629356992754530251344034023851",
                "169439940570265881714889666568925956111",
                "42993313022431523174938375848991795382",
                "176977637630608724214357553495415646348",
                "28585317047481199772613180682645127621",
                "44416698591747841536019793792240578406",
                "125261097626948597346511886007588838085",
                "232691229264113619248130254463918680461",
                "168286781640882379597710001596462508651",
                "176267713712148653690205052540341794143",
                "284218290897837362960519902706802532574",
                "100484001876799786742075553784489374595",
                "92366902690213444316553573087649833709",
                "273920440173799401833091192616770718205",
                "6087091128726032244366302303781221283",
                "242709083424408389732790141010086168630",
                "185010684148894369451847070219200920257",
                "326364397922559315961070092353118329777",
                "233304515239769291909183840725857768191",
                "102810562262335505279519781121753743925"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48778-12598bcd",
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614",
        "target": {
            "file": "PowerEditor/src/WinControls/FileBrowser/fileBrowser.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 3166.0,
            "function_hash": "279420604499050548160321103830044108333"
        },
        "id": "CVE-2026-48778-422d6065",
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614",
        "target": {
            "function": "Notepad_plus::checkDocState",
            "file": "PowerEditor/src/Notepad_plus.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 34456.0,
            "function_hash": "43607104269573927827600832733266841933"
        },
        "id": "CVE-2026-48778-783fc642",
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614",
        "target": {
            "function": "NppParameters::feedGUIParameters",
            "file": "PowerEditor/src/Parameters.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 32930.0,
            "function_hash": "63324965148463137471281371312978690260"
        },
        "id": "CVE-2026-48778-78bc409b",
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614",
        "target": {
            "function": "Notepad_plus::notify",
            "file": "PowerEditor/src/NppNotification.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 23411.0,
            "function_hash": "112486843452935489408814958001212969092"
        },
        "id": "CVE-2026-48778-78d03b9b",
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614",
        "target": {
            "function": "NppParameters::createXmlTreeFromGUIParams",
            "file": "PowerEditor/src/Parameters.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 107382.0,
            "function_hash": "87271981076174897286977297453387561257"
        },
        "id": "CVE-2026-48778-88daefe8",
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614",
        "target": {
            "function": "Notepad_plus::command",
            "file": "PowerEditor/src/NppCommands.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "282352191854347708547281380746248882760",
                "288921997509041343024713439550816088153",
                "279588123858745919469934241568706347157",
                "283930580948694904998302502338496735710",
                "309076803299162229527126389506982122835",
                "271268127124866954553490611286648858031",
                "144208066462221632709255722563837268506",
                "56852239145898973188168979917493932903",
                "303213127586338108761162219204802441632",
                "283823191272735417064780945648739989552",
                "76633056629639767372306803797940368624",
                "288550347358593388960840861682851409323",
                "215989511060407516135586332575479423370",
                "207041561716749825051728741432813090632",
                "115285960031530488435456167755773737497",
                "25269812952101932425217732964592634751",
                "143376927246674748025050606517314398500",
                "58932521541695240783545474266049839430",
                "4584005253421837847735850391299744284",
                "133525126415010861767503672279751016148",
                "108233393394346401703699388280059233854",
                "218826412477604576912881659617219840694",
                "133505076685785459100592914717471534552",
                "205635668141445235738334457312291094835",
                "32492207193574257172773974276186900137",
                "174624568109557960832897569063104445493"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48778-96d86019",
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614",
        "target": {
            "file": "PowerEditor/src/Parameters.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 3371.0,
            "function_hash": "66426694836895364657056723225008233295"
        },
        "id": "CVE-2026-48778-c280d14b",
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614",
        "target": {
            "function": "FileBrowser::popupMenuCmd",
            "file": "PowerEditor/src/WinControls/FileBrowser/fileBrowser.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 3525.0,
            "function_hash": "318925269122123989401331831997821305102"
        },
        "id": "CVE-2026-48778-c61b236e",
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614",
        "target": {
            "function": "FileBrowser::initPopupMenus",
            "file": "PowerEditor/src/WinControls/FileBrowser/fileBrowser.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "226910095778786956096264912696819696874",
                "31828160031156081201828472246132213768",
                "11613273851825106210961971492790638793",
                "17020532298737589155559898984949119416",
                "261510005210722323727539954942584923326",
                "461062546501921750512572907406759627",
                "131118736764200584180836600414337764161",
                "175940765074182517000991115227937049820"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48778-d2c01082",
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614",
        "target": {
            "file": "PowerEditor/src/NppNotification.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "159821191204308042385163136082421713446",
                "57662782448982694498845824031833267529",
                "39302789924277115687855442705992631341",
                "179281636706210601891069698224510532648",
                "218810638335913816148641881156674430920",
                "33391790208779244417827627980159817015",
                "84559633307319404363229101829200354280"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48778-e62dd84a",
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614",
        "target": {
            "file": "PowerEditor/src/NppCommands.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "54940300060031876810190721312158442507",
                "95360130453493856899052672425574546001",
                "255440408429619437757541240096128298704",
                "81423966128252114705831388475218509344",
                "51852320012302861095066896712052492546",
                "69203870778451100504223158718265677757",
                "96549694264451516433166728589144888069",
                "231261010374784931433009048374148260680",
                "220391311238879382979559909269475993511"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48778-efc766cf",
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614",
        "target": {
            "file": "PowerEditor/src/Parameters.h"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "285385969618049054612449241837443370996",
                "82786991223535896801089636203742895460",
                "280099708527575425435486100290171881255",
                "265674737773574096632510907488319129567"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48778-fee8f855",
        "source": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/24c7b5c63cece76dbc8c4f2607a27ebfe22fa614",
        "target": {
            "file": "PowerEditor/src/Notepad_plus.cpp"
        }
    }
]