CVE-2026-42214
An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.24% probability · 16th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- dail8859/notepad next
- Source
- security-advisories@github.com
References
- https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95cccPatch
- https://github.com/dail8859/NotepadNext/releases/tag/v0.14Release Notes
- https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54gExploit, Mitigation, Vendor Advisory
- https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54gExploit, Mitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.