CVE-2026-73250

MediumCVSS 5.4/10Last modified Sep 9, 2026

Description

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.

Metrics

CVSS 4.0 5.4/10CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-77

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
notepad-plus-plusnotepad-plus-plus< 8.9.7

References

Timeline

Published
Aug 11, 2026
Last modified
Sep 9, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-732519.1Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client CVE-2026-732527.5Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.CVE-2026-732539.1Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for aCVE-2026-732545.4Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name caCVE-2026-732556.5Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory tCVE-2026-732569.1Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proCVE-2026-732579.1Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request coCVE-2026-732586.5Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in muCVE-2026-732595.4Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to CVE-2026-73268.8A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker whCVE-2026-732607.5Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails CVE-2026-732617.5Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_built