NotepadNext’s detectLanguageFromExtension() function inserts the file’s extension directly into a Lua script without any validation. A specially crafted filename with malicious Lua code in its extension will have that code executed automatically when the user opens the file. Because luaL_openlibs() is called unconditionally, the Lua environment includes the full os, io, and package libraries, providing the attacker complete command‑execution capability within the context of the user's account. This vulnerable pathway allows the attacker to execute arbitrary Lua code, effectively enabling arbitrary command execution.

The vulnerability exists in all releases of NotepadNext from the dail8859 project before version 0.14. Users who deploy the open‑source editor from GitHub without upgrading to the v0.14 release or later are susceptible to exploitation.

The CVSS score of 7.8 indicates a high risk. The EPSS score is not available, and the flaw is not catalogued in CISA KEV. Attackers must supply a file with a malicious extension and compel a victim to open it—likely through phishing, malicious downloads, or a supply‑chain vector. When executed, the injected Lua code runs with full standard‑library access, enabling the attacker to run any system command. Given its CVSS of 7.8 and ability to execute arbitrary commands, the vulnerability poses significant risk.