A vulnerability in Notepad++ prior to version 8.9.8 allows local attackers to bypass security controls and execute arbitrary OS commands within the current user context.

This is an OS command injection vulnerability caused by insufficient validation of the shortcuts.xml file. An attacker with local access can exploit the WM_MACRODLGRUNMACRO entry point to trigger malicious macros that bypass standard UI restrictions and execute commands in the context of the user running the application.

While the CVSS score of 6.7 is categorized as medium, the potential for arbitrary code execution poses a significant risk to endpoint integrity. Successful exploitation could lead to full compromise of the user account, potentially allowing attackers to install persistent backdoors, exfiltrate sensitive local data, or pivot to other network resources.

Immediate Action: Update Notepad++ to version 8.9.8 or later immediately to apply the required HMAC validation logic.

Proactive Monitoring: Monitor endpoint logs for suspicious child processes spawned by the Notepad++ executable, particularly those associated with macro execution or unusual command-line arguments.

Compensating Controls: Restrict write access to the Notepad++ installation directory and configuration files, specifically the shortcuts.xml file, to prevent unauthorized modification by low-privileged users.

Public Exploit Available: Unknown

Given the capability for arbitrary command execution, organizations should prioritize updating all instances of Notepad++ to version 8.9.8. Ensuring that standard users operate with the principle of least privilege will further reduce the impact of this vulnerability by limiting the context in which a successful exploit would execute.