Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.4

Notepad++ installer can run malicious PowerShell commands

CVE-2026-73250 · published 2 months ago
Summary

The Notepad++ installer for Windows 11 (x64 and ARM64) before version 8.9.7 lets an attacker place special characters in the installation folder path to cause PowerShell commands to run with the installer’s privileges. This could allow unwanted code execution when the program’s context menu is used. Upgrade to Notepad++ 8.9.7 or later to stop the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
notepad-plus-plus notepad-plus-plus < 8.9.7
Original advisory text
Notepad++: Install-time PowerShell command injection through installation path
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-77Command Injection
Timeline
Published11 Aug 2026
Updated4 Nov 2026
First seen11 Aug 2026
Sources
CVE-2026-73250 · NVD
CVE-2026-73250 · MITRE
GHSA-gp2r-262h-9hgf · GHSA
CVE-2026-73250 · OSV
Track software like this
Free during beta