CVE-2026-25926

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

No affected versions have been published.

Timeline

Published: Feb 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-259277.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the DICOM CVE-2026-259286.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/exp CVE-2026-259296.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the documen CVE-2026-25936.4The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `_gspb_post_css CVE-2026-259306.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Layout-CVE-2026-259317.8vscode-spell-checker is a basic spell checker that works well with code and documents. Prior to v4.5.4, DocumentSettings._determineIsTrusted CVE-2026-259324.8GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payl CVE-2026-259336.8Arduino App Lab is a cross-platform IDE for developing Arduino Apps. Prior to 0.4.0, a vulnerability was identified in the Terminal componen CVE-2026-259344.3go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git where CVE-2026-259355.4Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the d CVE-2026-259368.8GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can p CVE-2026-259376.5GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with know