CVE-2026-85288

MediumCVSS 6.7/10Last modified Sep 26, 2026

Description

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback() without the validation used by command(). A tampered shortcuts.xml macro that is blocked through the Macro menu or a shortcut key can therefore execute through the multi-run dialog and invoke internal Notepad++ commands, including commands that launch external programs, in the current user context. This issue is fixed in version 8.9.8.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-345 CWE-693

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
notepad-plus-plus	notepad-plus-plus	< 8.9.8

References

Timeline

Published: Sep 22, 2026
Last modified: Sep 26, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-852896.5InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensur CVE-2026-85298.8Heap buffer overflow in Codecs in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox CVE-2026-852905.3InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::rec CVE-2026-852916.5InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::ch CVE-2026-852924.8InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's User_Cont CVE-2026-852934.8InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane st CVE-2026-852959.8Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.CVE-2026-852966.5Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4 CVE-2026-852977.7Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access propri CVE-2026-852987.3An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integrat CVE-2026-852998.3A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prio CVE-2026-85308.3Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer pro