# Insufficient sanitizing can lead to arbitrary commands execution

Notepad++ 'Open Containing Folder->cmd' expands environment variables in folder names, letting a crafted %VAR% name inject commands past the quote fix.

- Payout: hidden
- Severity: medium
- Program: Notepad++
- Found by: mrnbayoh
- Disclosed: 2019-06-06
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/494979
- Library page: https://bugbountylibrary.com/r/h1%3A494979
- Tags: area:os domain:desktop impact:rce kind:bounty platform:hackerone sev:medium tech:windows technique:incomplete-fix technique:source-review vuln:command-injection vuln:rce

**Target:** Notepad++ NppCommand.cpp 'Open Containing Folder->cmd' feature on Windows
**Root cause:** The command string `cmd /K cd /d "$(CURRENT_DIRECTORY)"` quotes the directory but cmd.exe still expands %VAR% environment variables inside the quoted path, so a variable containing a quote breaks out of the quoting.
**Steps:**
1. Set environment variable `TEST` to value `"`
2. Create folder named `%TEST%  && mkdir boom` containing `test.txt`
3. Open `test.txt` in Notepad++ and choose File->Open Containing Folder->cmd
4. cmd.exe expands `%TEST%` to `"`, escaping the quote, and executes `&& mkdir boom`
**How found:** Reviewed NppCommand.cpp, noticed the earlier commit added `\"` to prevent RCE, and hypothesized cmd.exe environment-variable expansion inside the quoted path could reintroduce injection.
**Exploitation:** Attacker controls a folder name (e.g. via archive extraction or shared directory); victim opens a file in it and uses Open Containing Folder->cmd, causing cmd.exe to expand the env var and run injected commands in the victim's context.
**Insight:** When a fix wraps a path in quotes for cmd.exe, remember %VAR% expansion happens inside quotes too; test folder/file names containing %VAR% where the variable value holds a quote to break out.