CVE-2026-42214

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42214", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-25T05:04:37.028Z", "datePublished": "2026-05-07T18:14:20.246Z", "dateUpdated": "2026-05-09T03:55:59.742Z"}, "containers": {"cna": {"title": "Improper Control of Generation of Code ('Code Injection') in dail8859/NotepadNext", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g"}, {"name": "https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc", "tags": ["x_refsource_MISC"], "url": "https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc"}, {"name": "https://github.com/dail8859/NotepadNext/releases/tag/v0.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/dail8859/NotepadNext/releases/tag/v0.14"}], "affected": [{"vendor": "dail8859", "product": "NotepadNext", "versions": [{"version": "< 0.14", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T18:14:20.246Z"}, "descriptions": [{"lang": "en", "value": "Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14."}], "source": {"advisory": "GHSA-m5fq-c9x5-w54g", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-08T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-42214"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-09T03:55:59.742Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42214", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-07T19:00:40.324092Z"}}}], "references": [{"url": "https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-07T19:00:53.424Z"}}], "cna": {"title": "Improper Control of Generation of Code ('Code Injection') in dail8859/NotepadNext", "source": {"advisory": "GHSA-m5fq-c9x5-w54g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "dail8859", "product": "NotepadNext", "versions": [{"status": "affected", "version": "< 0.14"}]}], "references": [{"url": "https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g", "name": "https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc", "name": "https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/dail8859/NotepadNext/releases/tag/v0.14", "name": "https://github.com/dail8859/NotepadNext/releases/tag/v0.14", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-07T18:14:20.246Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42214", "state": "PUBLISHED", "dateUpdated": "2026-05-09T03:55:59.742Z", "dateReserved": "2026-04-25T05:04:37.028Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-07T18:14:20.246Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "NotepadNext", "vendor": "dail8859", "versions": [{"status": "affected", "version": "< 0.14"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dail8859:notepad_next:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6AC89E0-BB00-45B6-8174-621BADBAC976", "versionEndExcluding": "0.14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension() function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which executes automatically when the victim opens the file in NotepadNext. Because luaL_openlibs() is called unconditionally, the full os, io, and package libraries are available to the injected code, enabling arbitrary command execution. This issue has been patched in version 0.14."}, {"lang": "es", "value": "Notepad Next es una reimplementaci\u00f3n multiplataforma de Notepad++. Antes de la versi\u00f3n 0.14, la funci\u00f3n detectLanguageFromExtension() de NotepadNext interpola la extensi\u00f3n de un archivo directamente en un script Lua sin sanitizaci\u00f3n. Un atacante puede crear un nombre de archivo cuya extensi\u00f3n contiene c\u00f3digo Lua, que se ejecuta autom\u00e1ticamente cuando la v\u00edctima abre el archivo en NotepadNext. Dado que luaL_openlibs() se llama incondicionalmente, las bibliotecas completas os, io y package est\u00e1n disponibles para el c\u00f3digo inyectado, lo que permite la ejecuci\u00f3n arbitraria de comandos. Este problema ha sido parcheado en la versi\u00f3n 0.14."}], "id": "CVE-2026-42214", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42214", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-08T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-05-07T19:16:01.497", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/dail8859/NotepadNext/commit/f3ca1b10aca52f05fd7f4f5ebf9b566d6cd95ccc"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/dail8859/NotepadNext/releases/tag/v0.14"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/dail8859/NotepadNext/security/advisories/GHSA-m5fq-c9x5-w54g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "NotepadNext", "source": "cna", "vendor": "dail8859"}, "product": "notepadnext", "vendor": "dail8859"}], "created": "2026-05-07T21:24:33.340258+00:00", "updated": "2026-05-07T21:30:25.965018+00:00", "vendors": ["dail8859", "dail8859$PRODUCT$notepadnext"]}