{"id":"CVE-2026-73250","title":"Notepad++ is a free and open-source source code editor","summary":"Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a Powe…","severity":"none","cwe":["CWE-77"],"published":"2026-08-11","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:58:37.713","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73250","references":[{"url":"https://github.com/notepad-plus-plus/notepad-plus-plus/commit/3764d5b72664ef95421bc53bcb204f9b977d346b","label":"security-advisories@github.com"},{"url":"https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.7","label":"security-advisories@github.com"},{"url":"https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-gp2r-262h-9hgf","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00129,"epssPercentile":0.0289,"ingestedAt":"2026-09-09T21:22:45.530Z","slug":"CVE-2026-73250","body":"## Overview\n\nNotepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}