# Notepad++ v8.9.6 — Critical Arbitrary Code Execution via config.xml commandLineInterpreter and shortcuts.xml (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800)

> Notepad++ versions <= v8.9.6 are affected by three vulnerabilities patched in v8.9.6.1 (released 2026-05-26): CVE-2026-48778 and CVE-2026-48800 are critical arbitrary code execution flaws caused by Notepad++ reading attacker-controlled XML values from config.xml (<GUIConfig name="commandLineInterpreter">) and shortcuts.xml and passing them directly to ShellExecute() with no validation, whitelist, or signature check. A public PoC replaces the interpreter value with calc.exe and triggers Windows Calculator when the user invokes File -> Open Containing Folder -> cmd. CVE-2026-48770 is a high-severity crash via malformed XML structure.

- **Published:** 2026-05-28T00:00:00Z
- **Last reviewed:** 2026-05-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0613
- **ID:** TL-2026-0613
- **Severity:** CRITICAL (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48770, CVE-2026-48778, CVE-2026-48800

## Description

Notepad++ is one of the most widely deployed Windows source-code editors, present on millions of developer workstations and enterprise endpoints. On 2026-05-26 the Notepad++ project released v8.9.6.1, patching three vulnerabilities disclosed by independent security researchers and summarised in Cyber Security News (2026-05-28).

## CVE-2026-48778 — Arbitrary Code Execution via config.xml (CRITICAL)

Notepad++ persists user preferences in %APPDATA%\Notepad++\config.xml. Among many tags is <GUIConfig name="commandLineInterpreter">, which holds the path to the shell invoked by the File -> Open Containing Folder -> cmd context menu. At load time, Parameters.cpp calls NppXml::value() to extract the tag's text content and stores it verbatim — no whitelist, no canonicalisation against %SystemRoot%\System32, no Authenticode check, no length cap.

When the user selects Open Containing Folder -> cmd, Notepad++ builds a command object from the stored string and hands it to ShellExecute(). Because ShellExecute() honours .exe extensions, fully-qualified paths and even URL handlers, the attacker has direct code execution as the interactive user. A publicly demonstrated PoC sets the tag to calc.exe and launches Windows Calculator the next time the menu item is used — confirming full arbitrary code execution capability.

## CVE-2026-48800 — Arbitrary Code Execution via shortcuts.xml (CRITICAL)

Shares the exploitation pattern of CVE-2026-48778 but targets shortcuts.xml (%APPDATA%\Notepad++\shortcuts.xml), the file storing user-bound keyboard shortcuts and macro command associations. The same NppXml::value() -> ShellExecute() flow allows an attacker who can write shortcuts.xml to inject an executable that fires when the bound keystroke or menu item is triggered.

## CVE-2026-48770 — Crash via malformed XML (HIGH)

Notepad++ fails to gracefully handle malformed XML structure during configuration parsing, leading to an application crash. While the crash itself is not remote code execution, it provides denial-of-service capability and may be useful as a precursor primitive for race conditions or partial-state corruption.

## Attack Vectors

Four realistic delivery paths are documented in the disclosure:

1. **Direct same-user write** — Any process running under the victim's user account (low-priv malware, a malicious script, an unsigned tool the user ran once) can drop a tampered config.xml or shortcuts.xml into %APPDATA%\Notepad++\. No elevation required.
2. **Malicious .lnk + -settingsDir= flag** — Notepad++ accepts a -settingsDir=<path> command-line flag that overrides the location of its configuration directory. An attacker delivering a shortcut (or a phishing email with a .lnk attachment) can point Notepad++ at an attacker-staged settings directory containing the tampered XML. The user simply launching the shortcut is sufficient.
3. **Cloud sync poisoning** — Notepad++ supports a user-configurable cloud path for settings. Compromise of the cloud storage account (or of a single endpoint in a sync group) propagates the tampered config to every other endpoint in the same sync set.
4. **Archive extraction social engineering** — Crafted archives (zip/rar/7z) containing a config.xml under a relative AppData-like path can be tricked into landing in %APPDATA%\Notepad++\ via path-traversal-aware extractors or simple user error.

## Exploitation Reliability

The attack is deterministic: any time the user invokes the affected menu item or shortcut, the planted payload executes. No memory corruption, no ASLR/DEP bypass, no race window. Triggering does require user interaction (Open Containing Folder -> cmd, or the bound keystroke), which is why CVSS scoring places this in the local/user-interaction band rather than network-remote — but in interactive desktop environments it is essentially click-to-pwn.

## Detection and Defensive Implications

Because the payload runs as the Notepad++ child process via ShellExecute(), defenders should focus on:
- Parent-child anomalies: notepad++.exe spawning anything other than cmd.exe / powershell.exe with the expected commandline
- File integrity monitoring on %APPDATA%\Notepad++\config.xml and shortcuts.xml
- Command-line argument inspection for the -settingsDir= flag on notepad++.exe invocations
- Suspicious .lnk files in user profile directories referencing notepad++.exe with -settingsDir=

Vendor mitigation should add a whitelist of interpreter paths, canonicalise against %SystemRoot%\System32, and surface a user confirmation dialog before executing the configured shell. None of these mitigations are present in v8.9.6.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1080 Taint Shared Content
- T1204 User Execution
- T1204.002 Malicious File
- T1204.001 Malicious Link
- T1059 Command and Scripting Interpreter
- T1059.003 Windows Command Shell
- T1059.001 PowerShell
- T1203 Exploitation for Client Execution
- T1574 Hijack Execution Flow
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1112 Modify Registry
- T1070 Indicator Removal

## Sources

- [Critical Notepad++ Vulnerabilities Allow Attackers to Execute Arbitrary Code](https://cybersecuritynews.com/critical-notepad-vulnerabilities/)
- [Notepad++ Official Downloads Page](https://notepad-plus-plus.org/downloads/)
- [Notepad++ GitHub Repository](https://github.com/notepad-plus-plus/notepad-plus-plus)
- [CVE-2026-48770 — NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-48770)
- [CVE-2026-48778 — NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-48778)
- [CVE-2026-48800 — NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-48800)
- [MITRE ATT&CK T1059 — Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
- [MITRE ATT&CK T1574 — Hijack Execution Flow](https://attack.mitre.org/techniques/T1574/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0613