Notepad++ 8.9.8 and earlier contained a path resolution flaw in the "Run by system" feature for text files. When a user selects a .txt file and invokes this command, the application mistakenly resolves a sibling file with the same base name plus a .cmd extension. If an attacker places a malicious command script next to the selected file, Notepad++ can execute that script with the current user's privileges. This defect allows an attacker to run arbitrary commands as the user without needing elevated permissions, effectively granting local command execution.

The issue applies to Windows 10 and Windows 11 machines running any Notepad++ version prior to 8.9.8, regardless of other features installed. The vulnerability is triggered when the "Run by system" option is used on a text file on the local filesystem.

The vulnerability has a CVSS score of 7.8, indicating a high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting at this time that exploitation is considered possible but not widely demonstrated. Attackers need only a local user who enables the run option and has control over the filesystem to place a malicious .cmd file, so the attack vector is local and user‑initiated. The risk is moderate to high for users who frequently run files from untrusted locations.