Notepad++ 8.9.6.1 and earlier read the <GUIConfig name="commandLineInterpreter"> entry from config.xml without any validation, allowing a malicious string to be executed as a program path. The absence of a whitelist or signature check turns this configuration value into an OS command injection point (CWE‑78). An attacker who can modify or supply a config.xml file can cause Notepad++ to launch arbitrary code when a user chooses File → Open Containing Folder → cmd, effectively enabling execution of arbitrary programs on the victim’s machine.

The vulnerability affects the Notepad++ source code editor, specifically releases prior to version 8.9.6.1. All users running these earlier versions on any operating system where Notepad++ is installed are potentially exposed.

Based on the description, the CVSS score of 7.8 indicates high severity. The vulnerability is not listed in the CISA KEV catalog, and no EPSS score is available. The path to exploitation appears to require a local user or process that can modify or replace the config.xml file and then trigger the file-open command, demonstrating a local attack vector. The insecure value limits the command execution to the scope of the user running Notepad++. Because of the local nature and lack of remote access, this is unlikely to be exploited remotely, but any local user with write access to config.xml can execute arbitrary programs. This combination of a high CVSS score, a local execution path, and no current exploitation evidence suggests a significant risk to affected systems.