CVE-2026-71858— Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution
Possible ATT&CK Techniques 3AI
T1055.002 · Portable Executable Injection T1556.002 · Password Filter DLL T1204.002 · Malicious FileGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-71858
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution
Source: CVE Program / CVE List V5
Vulnerability Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++ process, allowing protected file modification and conditional elevated command execution when a local attacker influences settingsDir and a user triggers the macro. This issue is fixed in version 8.9.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| notepad-plus-plus | notepad-plus-plus | < 8.9.7 | - |
II. Public POCs for CVE-2026-71858
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-71858
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-71858 (1)
Vendor Advisories for CVE-2026-71858 (1)
Vendor Pages for CVE-2026-71858 (1)
Same Patch Batch · notepad-plus-plus · 2026-08-17 · 4 CVEs total
| CVE-2026-57233 | 8.1 HIGH | Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction |
| CVE-2026-54758 | 7.8 HIGH | Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs |
| CVE-2026-52886 | 5.1 MEDIUM | Notepad++: session.xml backupFilePath starts_with Bypass |
IV. Related Vulnerabilities
Same product: notepad-plus-plus
- CVE-2026-57233
Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extrac - CVE-2026-52886
Notepad++: session.xml backupFilePath starts_with Bypass - CVE-2026-54758
Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs - CVE-2026-73250
Notepad++: Install-time PowerShell command injection through - CVE-2026-48770
Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash
Same vendor: notepad-plus-plus
- CVE-2026-57233
Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extrac - CVE-2026-52886
Notepad++: session.xml backupFilePath starts_with Bypass - CVE-2026-54758
Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs - CVE-2026-73250
Notepad++: Install-time PowerShell command injection through - CVE-2026-48770
Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash
Same weakness: CWE-78
- CVE-2026-75094
COMFAST CF-N1-S CGI mbox-config sub_44B438 os command inject - CVE-2026-71472
Acm-search-v2-rhel9: search-v2-operator: shell-command and s - CVE-2026-68519
Glances: `--disable-config-exec` does not cover on-alert act - CVE-2026-62982
Glances: Incomplete fix of CVE-2026-32608: action-template s - CVE-2026-68518
Glances: Command injection bypass of action-template sanitiz
V. Comments for CVE-2026-71858
No comments yet