CVE-2026-73250: Notepad++: Install-time PowerShell command injection through installation path
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory $INSTDIR from PowerEditor/installer/nppSetup.nsi into a PowerShell -Command string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as $() in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Notepad++to a version that resolves this vulnerability.Fixed in 8.9.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73250?
The severity of CVE-2026-73250 is rated at 55, indicating a moderate risk due to potential command injection vulnerabilities.
How do I fix CVE-2026-73250?
To fix CVE-2026-73250, upgrade to Notepad++ version 8.9.7 or later to close the vulnerability.
What types of systems are affected by CVE-2026-73250?
CVE-2026-73250 affects the Notepad++ installer on Windows 11 x64 and ARM64 systems prior to version 8.9.7.
What kind of vulnerability is CVE-2026-73250?
CVE-2026-73250 is categorized as a command injection vulnerability, allowing attackers to potentially execute arbitrary commands.
Who is responsible for addressing CVE-2026-73250?
The maintainers of Notepad++ are responsible for addressing CVE-2026-73250 through software updates and security patches.