CVE-2026-42214

Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc	Patch
https://github.com/dail8859/NotepadNext/releases/tag/v0.14	Release Notes
https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g	Exploit Mitigation Vendor Advisory
https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dail8859:notepad_next:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-07 19:16

Updated : 2026-06-17 10:47

NVD link : CVE-2026-42214

Mitre link : CVE-2026-42214

CVE.ORG link : CVE-2026-42214

JSON object : View

Products Affected

dail8859

notepad_next

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-42214", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42214", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-08T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dail8859", "product": "NotepadNext", "versions": [{"status": "affected", "version": "< 0.14"}]}]}], "published": "2026-05-07T19:16:01.497", "references": [{"url": "https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dail8859/NotepadNext/releases/tag/v0.14", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14."}], "lastModified": "2026-06-17T10:47:31.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dail8859:notepad_next:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6AC89E0-BB00-45B6-8174-621BADBAC976", "versionEndExcluding": "0.14"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}