CVE-2026-42214

Katalog CVE

CVSS 7.8 · High EPSS 0,28%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada dail8859 notepad next. Skor CVSS 3.1 7.8 (High) menurut github.com.

Deskripsi (NVD)

Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14.

Rincian

Terbit di NVD

7 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 19,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g exploit · mitigasi · advisory vendor
• https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc patch
• https://github.com/dail8859/NotepadNext/releases/tag/v0.14 release notes