CVE-2026-42214

Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc	Patch
https://github.com/dail8859/NotepadNext/releases/tag/v0.14	Release Notes
https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g	Exploit Mitigation Vendor Advisory
https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dail8859:notepad_next:*:*:*:*:*:*:*:*

History

26 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Notepad Next es una reimplementación multiplataforma de Notepad++. Antes de la versión 0.14, la función detectLanguageFromExtension() de NotepadNext interpola la extensión de un archivo directamente en un script Lua sin sanitización. Un atacante puede crear un nombre de archivo cuya extensión contiene código Lua, que se ejecuta automáticamente cuando la víctima abre el archivo en NotepadNext. Dado que luaL_openlibs() se llama incondicionalmente, las bibliotecas completas os, io y package están disponibles para el código inyectado, lo que permite la ejecución arbitraria de comandos. Este problema ha sido parcheado en la versión 0.14.

Information

Published : 2026-05-07 19:16

Updated : 2026-10-26 20:10

NVD link : CVE-2026-42214

Mitre link : CVE-2026-42214

CVE.ORG link : CVE-2026-42214

JSON object : View

Products Affected

dail8859

notepad_next

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-42214", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42214", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-08T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dail8859", "product": "NotepadNext", "versions": [{"status": "affected", "version": "< 0.14"}]}]}], "published": "2026-05-07T19:16:01.497", "references": [{"url": "https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dail8859/NotepadNext/releases/tag/v0.14", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14."}, {"lang": "es", "value": "Notepad Next es una reimplementaci\u00f3n multiplataforma de Notepad++. Antes de la versi\u00f3n 0.14, la funci\u00f3n detectLanguageFromExtension() de NotepadNext interpola la extensi\u00f3n de un archivo directamente en un script Lua sin sanitizaci\u00f3n. Un atacante puede crear un nombre de archivo cuya extensi\u00f3n contiene c\u00f3digo Lua, que se ejecuta autom\u00e1ticamente cuando la v\u00edctima abre el archivo en NotepadNext. Dado que luaL_openlibs() se llama incondicionalmente, las bibliotecas completas os, io y package est\u00e1n disponibles para el c\u00f3digo inyectado, lo que permite la ejecuci\u00f3n arbitraria de comandos. Este problema ha sido parcheado en la versi\u00f3n 0.14."}], "lastModified": "2026-10-26T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dail8859:notepad_next:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6AC89E0-BB00-45B6-8174-621BADBAC976", "versionEndExcluding": "0.14"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}