Skip to main content

Notepad Plus Plus CVE-2026-73250

| EUVDEUVD-2026-57017 MEDIUM
Command Injection (CWE-77)
2026-08-11 GitHub_M
Command Injection Microsoft Notepad Plus Plus
5.4
CVSS 4.0 · Vendor: GitHub_M
View

Vulnerability Assessment

Weakness
CWE
CWE-77
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 11, 2026

Command injection in the Notepad++ Windows 11 x64 and ARM64 installer prior to version 8.9.7 allows an attacker who can influence the installation directory path to execute arbitrary PowerShell commands in the installer's security context. The vulnerable RegisterMSIX function in the NSIS installer script (nppSetup.nsi) unsafely interpolates the $INSTDIR variable into a PowerShell -Command string, enabling subexpression syntax such as $() embedded in a crafted directory name to be evaluated as live commands. Exploitation additionally requires that the user selects the optional Explorer context menu shell extension component during installation. The vendor has confirmed the fix in version 8.9.7; no public exploit or active exploitation has been identified at time of analysis.

Affected VersionsENISA

notepad-plus-plus < 8.9.7

Affected Packages

euvd notepad_plus_plus fix: 8.9.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Notepad Plus Plus gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 5.4 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
Low
User Interaction
Active
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

1
Patch available
Aug 11, 2026 - 23:04 EUVD

DescriptionCVE.org

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory $INSTDIR from PowerEditor/installer/nppSetup.nsi into a PowerShell -Command string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as $() in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
Medium
Technical Impact
Total

Priority Score

27
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +27
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

More in Notepad Plus Plus

View all
CVE-2025-15556 HIGH
7.5 Feb 03

Notepad++ versions prior to 8.8.9 contain an update integrity verification vulnerability (CVE-2025-15556) when using the
CVE-2026-85279 HIGH POC
8.6 Sep 22

Loading a crafted Notepad++ plugin that reports more than 30 external lexers can overflow a 30-element stack array insid
CVE-2026-48778 HIGH POC
7.8 Jun 26

Local code execution in Notepad++ before 8.9.6.1 occurs because the <GUIConfig name="commandLineInterpreter"> value in c
CVE-2026-86054 HIGH POC
7.8 Sep 22

Notepad++ installations prior to 8.9.8 crash when a local attacker can control the -settingsDir= command-line argument a
CVE-2026-77605 HIGH POC
7.8 Sep 22

Arbitrary code execution in Notepad++ prior to 8.9.8 on Windows 10 and Windows 11 occurs when the editor's 'Folder as Wo
CVE-2023-47452 HIGH POC
7.8 Nov 30

An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msim
CVE-2023-40031 HIGH POC
7.8 Aug 25

Notepad++ is a free and open-source source code editor. Rated high severity (CVSS 7.8), this vulnerability is no authent
CVE-2022-32168 HIGH POC
7.8 Sep 28

Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (Ux
CVE-2019-16294 HIGH POC
7.8 Sep 14

SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode ch
CVE-2026-85995 HIGH POC
7.3 Sep 22

Improper signature verification in the Notepad++ updater path allows a locally planted or modified GUP.exe updater binar
CVE-2026-25926 HIGH POC
7.3 Feb 19

Notepad++ versions before 8.9.2 allow local code execution through an unsafe search path vulnerability that permits atta
CVE-2026-85288 MEDIUM POC
6.7 Sep 22

Notepad++ releases prior to 8.9.8 enforce their shortcuts.xml HMAC integrity check on the Macro menu and keyboard-shortc

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2016-3081 HIGH POC
8.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/388816 REF https://github.com/notepad-plus-plus/notepad-plus-plus/commit/3764d5b72664ef95421bc53bcb204f9b977d346b REF https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.7 REF https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-gp2r-262h-9hgf

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy