Medium severity · published Aug 11, 2026
CVE-2026-73250
Notepad++: Install-time PowerShell command injection through installation path
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
notepad-plus-plus · notepad-plus-plus
< 8.9.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73250
github.com
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/3764d5b72664ef95421bc53bcb204f9b977d346b
github.com
https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.7
github.com
https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-gp2r-262h-9hgf
More from notepad-plus-plus
7.5
CVE-2025-15556
Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification
8.6
CVE-2026-85279
Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value
8.1
CVE-2026-57233
Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
7.8
CVE-2026-77605
Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)
7.8
CVE-2026-86054
Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path