CVE-2026-42214

Description

Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14.

Traduire en français

Produits concernés

• dail8859 NotepadNext
• Dail8859 notepad next

Scores CVSS

Faiblesses (CWE)

• CWE-94

Références

• https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc Patch
• https://github.com/dail8859/NotepadNext/releases/tag/v0.14 Release Notes
• https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g ExploitMitigationVendor Advisory
• https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g ExploitMitigationVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories