vulnerability
NotepadPlusPlus: CVE-2026-48800: Improper Neutralization of Special Elements used in an OS Command
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:M/Au:S/C:C/I:C/A:C) | May 26, 2026 | Jun 1, 2026 | Jun 1, 2026 |
Severity
9
CVSS
(AV:N/AC:M/Au:S/C:C/I:C/A:C)
Published
May 26, 2026
Added
Jun 1, 2026
Modified
Jun 1, 2026
Description
Notepad++ allows arbitrary code execution via the Command tag inside UserDefinedCommands in shortcuts.xml. The tag content is passed to ShellExecute without validation when the user clicks the corresponding Run menu entry.
Solution
notepadplusplus-upgrade
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.