CVE-2026-73250

Received Received - Intake

PowerShell Code Execution in Notepad++ Installer

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73250

Affected Vendors & Products

Vendor	Product	Version / Range
notepad++	notepad++	8.9.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in Notepad++ before version 8.9.7 allows an attacker to execute arbitrary commands during installation by manipulating the installation directory path. The installer passes a user-controlled path to a PowerShell command, which can include PowerShell subexpression syntax like $() to run malicious commands in the installer's security context.

Detection Guidance

This vulnerability is specific to Notepad++ versions prior to 8.9.7 during installation. Check the installed version by running 'notepad++ --version' or checking Help > About in the application. If version is below 8.9.7, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run malicious code on your system with the same privileges as the installer. This could lead to unauthorized access, data theft, or further compromise of your system.

Compliance Impact

This vulnerability allows arbitrary command execution during installation due to improper handling of the installation directory path. While it does not directly impact GDPR or HIPAA compliance, it could lead to unauthorized code execution on a system, potentially compromising sensitive data or violating compliance requirements if exploited.

Mitigation Strategies

Upgrade Notepad++ to version 8.9.7 or later immediately. Download the latest version from the official Notepad++ website. Avoid using third-party installers or modified versions.

Hi! I’m here to help you understand CVE-2026-73250. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70