User-defined command entries in shortcuts.xml are parsed by Notepad++ without validation. When the user selects a Run menu item that references one of these entries, the application constructs a command string and passes it to the operating system via ShellExecute. This path allows an attacker to supply an arbitrary executable path in the <Command> tag, leading to remote execution of malicious code. The injected command is visible as a standard menu item, providing a convenient persistence mechanism for attackers.

The flaw exists in the Notepad++ application prior to version 8.9.6.1. All installations of Notepad++ running a version older than 8.9.6.1 are susceptible, regardless of operating system, because the relevant parsing logic is part of the core command handling component.

The CVSS base score of 7.8 indicates a high impact vulnerability with moderate to high exploitability. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need local access and user interaction by opening and running Notepad++. The lack of input validation identified as CWE-78 allows injection of arbitrary commands, and the persistence via the Run menu makes it feasible for repeated exploitation.