Notepad++ requires urgent update: hackers swapping configs to run malware

Notepad++, a popular text and source code editor used by 28 million users, has released emergency patches fixing three critical vulnerabilities that can be exploited to run malware. A simple, crafted shortcut file can trigger an attack.

Don Ho, creator and maintainer of Notepad++, fixed three vulnerabilities in version 8.9.6.1. Two of them allow attackers to tamper with the text editor’s configuration files and achieve arbitrary code execution.

“Config.xml to ShellExecute. The shortest path I have ever traced from a source to a sink,” said Michele Piccinni, an independent security researcher who discovered the bugs.

Payloads can be injected into two Notepad++ XML files that have no validation, digital signatures, or other checks: config.xml and shortcuts.xml.

Attackers still need to get their hands on the system or trick a user into performing a malicious action themselves. But the exploitation is straightforward – injected payloads will run from XML whenever a user makes a specific action, such as clicking a menu entry.

The advisories list a few potential attack vectors:

• Attackers with initial access can simply edit the links or setting files directly to run payloads with the user’s privileges, and maintain persistence.
• Hackers can send a malicious .lnk (shortcut) file that points Notepad++ to open configuration files from an attacker-controlled directory. Double-clicking the shortcut would open a compromised Notepad++ instance.
• Cloud sync poisoning – attackers can compromise one of the accounts and push poisoned settings files down to a user's machine
• Malicious archives or installers, sneaking in bad configs, often via social engineering.

The two bugs are tracked as CVE-2026-48778 and CVE-2026-48800, and both have a severity rating of 7.8 out of 10.

The advisories further detail that the config.xml exploit triggers when users click File → Open Containing Folder → cmd. The payloads from shortcuts.xml trigger via injected menu entries.

The third patched Notepad++ bug is the least severe, but it can cause the program to crash reliably if any local process sends a malformed message.

The fix is out, and users are advised to update Notepad++ to v8.9.6.1 or later versions.

Notepad++ has been a target before. Earlier this year, suspected Chinese state-sponsored hackers hijacked the app’s update system to infect selected users with malware that ran undetected for months.

Unlock more exclusive Cybernews content on YouTube.