{"id":"CVE-2026-85288","aliases":["EUVD-2026-84571","GHSA-759j-g8j4-867p"],"status":"published","title":"Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the \"Run a Macro Multiple Times\" dialog","description":"Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback() without the validation used by command(). A tampered shortcuts.xml macro that is blocked through the Macro menu or a shortcut key can therefore execute through the multi-run dialog and invoke internal Notepad++ commands, including commands that launch external programs, in the current user context. This issue is fixed in version 8.9.8.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00136,"percentile":0.03035,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-345","CWE-693","CWE-78"],"published":"2026-09-22T17:11:47Z","modified":"2026-10-28T11:00:45Z","products":[{"vendor":"notepad-plus-plus","product":"notepad-plus-plus"}],"references":[{"url":"https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-759j-g8j4-867p","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/4cd74cb9347b9c6caaab17d999e24fc9ed228ff7","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8","tags":["x_refsource_MISC","web"]},{"url":"https://notepad-plus-plus.org/news/v898-released","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85288.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85288","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-85288","title":"Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the \"Run a Macro Multiple Times\" dialog","description":"Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback() without the validation used by command(). A tampered shortcuts.xml macro that is blocked through the Macro menu or a shortcut key can therefore execute through the multi-run dialog and invoke internal Notepad++ commands, including commands that launch external programs, in the current user context. This issue is fixed in version 8.9.8.","status":"published","published":"2026-09-22T17:11:47.937Z","modified":"2026-09-25T23:48:00.716Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-78","CWE-345","CWE-693"],"updated_at":"2026-11-02T14:19:52.410665Z"}],"euvd":[{"id":"EUVD-2026-84571","description":"Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback() without the validation used by command(). A tampered shortcuts.xml macro that is blocked through the Macro menu or a shortcut key can therefore execute through the multi-run dialog and invoke internal Notepad++ commands, including commands that launch external programs, in the current user context. This issue is fixed in version 8.9.8.","status":"published","published":"2026-09-22T17:11:47Z","modified":"2026-09-25T23:48:00Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:54.622662Z"}],"nvd":[{"id":"CVE-2026-85288","description":"Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback() without the validation used by command(). A tampered shortcuts.xml macro that is blocked through the Macro menu or a shortcut key can therefore execute through the multi-run dialog and invoke internal Notepad++ commands, including commands that launch external programs, in the current user context. This issue is fixed in version 8.9.8.","status":"published","published":"2026-09-22T18:17:23.373Z","modified":"2026-09-26T00:16:37.387Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-78","CWE-345","CWE-693"],"updated_at":"2026-11-02T14:12:50.368368Z"}],"osv":[{"id":"CVE-2026-85288","title":"Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the \"Run a Macro Multiple Times\" dialog","description":"Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback() without the validation used by command(). A tampered shortcuts.xml macro that is blocked through the Macro menu or a shortcut key can therefore execute through the multi-run dialog and invoke internal Notepad++ commands, including commands that launch external programs, in the current user context. This issue is fixed in version 8.9.8.","status":"published","published":"2026-09-22T17:11:47.937Z","modified":"2026-10-28T11:00:45.373676174Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-345","CWE-693","CWE-78"],"updated_at":"2026-11-02T15:45:18.825071Z"}]}}