High-Severity Notepad++ Flaws Let Attackers Run Malicious Code — Update Now

Update Notepad++ to v8.9.7 to patch high-severity flaws including CVE-2026-48778, which let attackers plant malicious executable paths.

By Content Team

May 28, 2026

ON THIS PAGE

Notepad++ has patched three security vulnerabilities in version v8.9.6.1, released May 26, 2026 — two of them rated High. The worst, CVE-2026-48778 (CVSS 7.8), lets attackers plant a malicious executable path inside Notepad++'s config.xml. When a user opens a folder via File → Open Containing Folder → cmd, Windows runs the attacker's program instead. No validation, no warning.

A second High-severity flaw, CVE-2026-48800, works the same way but targets shortcuts.xml. Neither gets an attacker onto your machine by itself: both need existing write access to your settings files, or a user tricked into loading a poisoned settings folder — through cloud-synced settings, a malicious shortcut, or archive extraction.

Anyone running v8.9.6 or earlier should update immediately from the official releases page.

Updated August 13, 2026: v8.9.6.1 is no longer enough. The CVE-2026-48800 fix was bypassed days later using path traversal and re-patched in v8.9.6.2; a TOCTOU flaw, CVE-2026-52885, followed in v8.9.6.4; and v8.9.7, released July 14, fixes five more, including another shortcuts.xml bypass. Update to v8.9.7 or later.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?