A code injection vulnerability in NotepadNext prior to version 0.14 allows attackers to achieve arbitrary command execution when a victim opens a maliciously crafted file, posing a severe risk to host integrity.

This is a code injection flaw (CWE-94) where the detectLanguageFromExtension function unsanitizedly interpolates file extensions into a Lua script, requiring local access and user interaction to trigger.

A successful exploit allows an attacker to execute arbitrary commands with the privileges of the user running NotepadNext, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network. This risk is justified by a high CVSS score of 7.8, reflecting severe confidentiality, integrity, and availability impacts upon successful execution.

Immediate Action: Update NotepadNext to version 0.14 or later where the code injection flaw is resolved.

Proactive Monitoring: Monitor endpoint detection and response logs for anomalous process spawning originating from the NotepadNext application directory.

Compensating Controls: Educate users on the risks of opening untrusted files from unverified sources, and enforce strict file type controls at mail gateways or file shares.

Public Exploit Available: No (no confirmed public exploit or weaponized module currently available)

Given the high severity and potential for total system compromise, administrators must prioritize updating NotepadNext to version 0.14 immediately. Applying this software update removes the unsafe interpolation vector and neutralizes the code injection threat.