NotepadNext CVE-2026-42214: Arbitrary Command Execution via Malicious Extensions

A critical vulnerability, tracked as CVE-2026-42214, has been identified in NotepadNext, a cross-platform re-implementation of Notepad++. Prior to version 0.14, the application’s detectLanguageFromExtension() function fails to sanitize file extensions before interpolating them directly into a Lua script. This oversight creates a significant security hole, allowing attackers to craft filenames with embedded Lua code that executes automatically when a victim opens the file in NotepadNext.

According to the National Vulnerability Database, the issue is exacerbated by NotepadNext’s unconditional call to luaL_openlibs(). This action makes the full os, io, and package libraries available to the injected code, granting arbitrary command execution capabilities to an attacker. The National Vulnerability Database assigns this vulnerability a CVSS score of 7.8 (HIGH), underscoring its severe impact on confidentiality, integrity, and availability.

This vulnerability has been patched in NotepadNext version 0.14. Defenders must recognize that the attacker’s calculus here is straightforward: social engineering a user into opening a seemingly innocuous file. The ease of exploitation, coupled with the high impact of arbitrary code execution, makes this a prime target for initial access. This isn’t just about data theft; it’s about full system compromise.