CVE-2026-73250 in Notepad++
Summary
by MITRE • 08/12/2026
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability affects Notepad++ versions prior to 8.9.7 and represents a critical command injection flaw in the Windows installer process. The issue stems from improper input validation within the PowerEditor/installer/nppSetup.nsi script where the `$INSTDIR` variable containing user-controllable installation path data is directly interpolated into a PowerShell `-Command` parameter without adequate sanitization or escaping mechanisms. When an attacker can influence this installation directory path, they can inject PowerShell subexpression syntax such as `$()` which enables arbitrary command execution within the installer's security context.
The technical implementation of this vulnerability occurs during the registration of MSIX packages through the RegisterMSIX component that utilizes Add-AppxPackage PowerShell cmdlet. The installer constructs a PowerShell command string by concatenating user-provided directory paths directly into the command parameter, creating an environment where malicious input can be interpreted as executable PowerShell code rather than mere path specification. This design flaw allows attackers to escalate privileges and execute arbitrary commands with the same permissions as the installer process, which typically runs with elevated privileges during installation.
The operational impact of this vulnerability is severe as it provides attackers with a means to execute arbitrary code during the installation process without requiring additional exploitation techniques. When users select the context menu component that triggers the RegisterMSIX functionality, the malicious PowerShell commands embedded within the installation path are automatically executed in the installer's security context, potentially allowing for privilege escalation, malware deployment, or system compromise. This vulnerability affects both x64 and ARM64 architectures of Notepad++ on Windows 11 systems, expanding its potential attack surface.
This vulnerability maps directly to CWE-94, which describes "Improper Control of Generation of Code ('Code Injection')" where an application allows untrusted input to be interpreted as code. Additionally, the issue aligns with ATT&CK technique T1059.001 for command and scripting interpreter execution through PowerShell, and T1068 for exploit for privilege escalation during installation processes. The vulnerability demonstrates poor input validation practices in installer scripts and highlights the critical importance of proper sanitization of user-controllable inputs when constructing command-line arguments or script parameters.
The mitigation strategy involves upgrading to Notepad++ version 8.9.7 or later, which properly handles the installation directory parameter by implementing proper input validation and escaping mechanisms before incorporating it into PowerShell command strings. Organizations should also implement application whitelisting policies that restrict execution of untrusted installer packages and monitor for unusual installation activities. System administrators should review existing Notepad++ installations to ensure they are updated to patched versions, as the vulnerability allows for arbitrary code execution during the installation phase without requiring user interaction beyond standard installation procedures.