Vulnerability · Published May 7, 2026 · Assigned by GitHub_M
CVE-2026-42214Improper Control of Generation of Code ('Code Injection') in dail8859/NotepadNext
High 7.8
In plain English
A high-severity code injection in NotepadNext from dail8859. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dail8859 | NotepadNext | < 0.14 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H