LOWVulnerability
CVE-2026-73250
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.
Properties
- epss_score
- 0.00129
- cve_id
- CVE-2026-73250
- published_at
- 2026-08-11T23:18:10.320
- last_modified
- 2026-09-09T20:58:37.713
- epss_percentile
- 0.02851
Related Entities (3)
ENRICHED_BY (1)
→[Source]FIRST EPSS
DESCRIBED_BY (1)
→[Source]NVD
HAS_WEAKNESS (1)
→[Weakness]Improper Neutralization of Special Elements used in a Command ('Command Injection')
Explore deeper with Ninja Signal's threat intelligence graph