CVE-2026-77605 — Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the f…
Published: 2026-09-22 · CVSS: 7.8 · CVSS 3.1
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd appended, and the user invokes Run by system on the text file on Windows 10 or Windows 11, Notepad++ can execute the sibling script as the current user instead of opening the selected file. This issue is fixed in version 8.9.8.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7