Read the docs
TI-2026-51387 Aliases CVE-2026-73250

Notepad++: Install-time PowerShell command injection through installation path

Priority LOW 26CWE-77Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0019 8th percentileScored 2026-11-07
Fix Fixed notepad-plus-plus (notepad-plus-plus): 8.9.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
notepad-plus-plusnotepad-plus-plusbefore 8.9.78.9.7Patch availableCNA
  • notepad-plus-plus Vendornotepad-plus-plus Affected before 8.9.7 Fixed in 8.9.7 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:notepad-plus-plus:notepad\+\+:*:*:*:*:*:*:*:*——notepad-plus-plus
  • cpe:2.3:a:notepad-plus-plus:notepad\+\+:*:*:*:*:*:*:*:* Versions — — ·notepad-plus-plus

Remediation

  • Fix · CNA notepad-plus-plus (notepad-plus-plus) Fixed in 8.9.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73250

References

Other 3

  • TI-2025-14195 Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification KEVCVSS 4.0HIGH 7.7
  • TI-2026-58566 Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value CVSS 3.1HIGH 8.6
  • TI-2026-58869 Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path CVSS 3.1HIGH 7.8
  • TI-2026-54091 Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution) CVSS 3.1HIGH 7.8
  • TI-2026-36070 Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection CVSS 3.1HIGH 7.8
  • TI-2026-36048 Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter CVSS 3.1HIGH 7.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences