{"id":"CVE-2026-85288","revision":"bbe00ee5671d43ab83c7faeb64b59285","records":[{"revision":"bbe00ee5671d43ab83c7faeb64b59285","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-85288","aliases":[],"title":"Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the \"Run a Macro Multiple Times\" dialog","description":"Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ incompletely enforces shortcuts.xml HMAC validation because WM_MACRODLGRUNMACRO, the Run a Macro Multiple Times entry point, calls macroPlayback() without the validation used by command(). A tampered shortcuts.xml macro that is blocked through the Macro menu or a shortcut key can therefore execute through the multi-run dialog and invoke internal Notepad++ commands, including commands that launch external programs, in the current user context. This issue is fixed in version 8.9.8.","state":0,"publishedAt":"2026-09-22T17:11:47.937+00:00","modifiedAt":"2026-09-25T23:48:00.716+00:00","affected":[{"ecosystem":"Vendor product","name":"notepad-plus-plus","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"notepad-plus-plus\",\n                    \"product\": \"notepad-plus-plus\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 8.9.8\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","score":6.7,"severity":"MEDIUM"}],"references":["https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-759j-g8j4-867p","https://github.com/notepad-plus-plus/notepad-plus-plus/commit/4cd74cb9347b9c6caaab17d999e24fc9ed228ff7","https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.8","https://notepad-plus-plus.org/news/v898-released"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-85288","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-85288","identifiers":["CVE-2026-85288"]},"retained":false,"historicalAffected":[]}],"coverage":[]}