Quick answers
- Is CVE-2026-73250 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73250 being exploited in the wild.
- How severe is CVE-2026-73250?
- Informational severity, published 11 August 2026.
- Which products and versions are affected?
- Notepad++ Notepad++ prior to 8.9.7.
- Is there a fix for CVE-2026-73250?
- A patch was published on 2024-07-14: Fixed in version 8.9.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-73250 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-73250?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a PowerShell command injection vulnerability in the Notepad++ Windows installer (nppSetup.nsi). The vulnerability occurs in the RegisterMSIX function, which passes the attacker-controlled installation directory ($INSTDIR) directly into a PowerShell -Command string without proper escaping. An attacker can inject PowerShell subexpression syntax such as $() to execute arbitrary commands. The attack requires local access and user interaction (selecting the context menu component during installation). The vulnerability affects Windows 11 x64 and ARM64 installers prior to version 8.9.7, where it was fixed by passing INSTDIR as an environment variable instead of inline in the command string.
Affected products
- Notepad++ Notepad++ prior to 8.9.7
Timeline
- 2026-08-11: disclosed
- 2024-07-14: patched: Fixed in version 8.9.7