CVE-2026-73250 Overview
CVE-2026-73250 is a command injection vulnerability [CWE-77] in the Notepad++ Windows 11 x64 and ARM64 installer prior to version 8.9.7. The installer passes the attacker-influenced installation directory $INSTDIR from PowerEditor/installer/nppSetup.nsi into a PowerShell -Command string used by RegisterMSIX to invoke Add-AppxPackage. PowerShell subexpression syntax such as $() embedded in the installation path executes commands in the installer's security context when the context menu component is selected. The issue is fixed in version 8.9.7.
Critical Impact
A crafted installation path can execute arbitrary PowerShell commands during Notepad++ installation, running in the installer's security context — typically elevated when installed system-wide.
Affected Products
- Notepad++ Windows 11 x64 installer prior to version 8.9.7
- Notepad++ Windows 11 ARM64 installer prior to version 8.9.7
- Installations that select the context menu component
Discovery Timeline
- 2026-08-11 - CVE-2026-73250 published to NVD
- 2026-08-11 - Last updated in NVD database
- Version 8.9.7 - Notepad++ releases fixed installer via GitHub Release v8.9.7
Technical Details for CVE-2026-73250
Vulnerability Analysis
The vulnerable code resides in PowerEditor/installer/nppSetup.nsi, which constructs a PowerShell command line using NSIS string interpolation. The installer builds a command such as Add-AppxPackage -Path "$INSTDIR\contextMenu\NppShell.msix" and passes it directly to powershell.exe -Command. Because PowerShell evaluates subexpressions $() inside double-quoted strings, any such syntax embedded in $INSTDIR is executed as PowerShell code rather than treated as a literal path. Exploitation requires the user to install Notepad++ into an attacker-influenced directory with the context menu component selected. See the GitHub Security Advisory GHSA-gp2r-262h-9hgf for full details.
Root Cause
The root cause is unsanitized string interpolation of the installation path into a PowerShell -Command argument. NSIS expands $INSTDIR at build/install time, and PowerShell then re-evaluates any $(...) subexpressions inside the resulting double-quoted string. This double-parsing turns a filesystem path into an execution context.
Attack Vector
Exploitation is local and requires user interaction. An attacker convinces a user to install Notepad++ into a directory whose name contains PowerShell subexpression syntax, for example C:\Tools\Npp$(calc)\. When the installer reaches RegisterMSIX and the context menu component is enabled, PowerShell evaluates the embedded subexpression and executes the attacker-supplied commands. If the installer is launched with elevated privileges — the default for system-wide installations — the injected commands inherit those privileges.
; Vulnerable code (before fix) in PowerEditor/installer/nppSetup.nsi
nsExec::ExecToLog '"$0" -Command "Add-AppxPackage -Path \"$INSTDIR\contextMenu\NppShell.msix\" -ExternalLocation \"$INSTDIR\contextMenu\""'
; Patched code (v8.9.7) — passes INSTDIR via environment variable
System::Call 'kernel32::SetEnvironmentVariableW(w "NPP_INSTDIR", w "$INSTDIR")'
nsExec::ExecToLog '"$0" -Command "Add-AppxPackage -Path \"$$env:NPP_INSTDIR\contextMenu\NppShell.msix\" -ExternalLocation \"$$env:NPP_INSTDIR\contextMenu\""'
Source: GitHub Commit 3764d5b — the patch replaces inline path interpolation with an environment variable reference, preventing PowerShell subexpression evaluation of the path.
Detection Methods for CVE-2026-73250
Indicators of Compromise
- Notepad++ installer processes (nppSetup*.exe) spawning powershell.exe with a -Command line containing $( inside the -Path or -ExternalLocation arguments
- Child processes of powershell.exe launched from an NSIS installer context, especially cmd.exe, rundll32.exe, or script interpreters
- Installation directory paths on disk containing shell metacharacters such as $(), backticks, or semicolons
- Unexpected Add-AppxPackage invocations paired with anomalous secondary process creation
Detection Strategies
- Monitor process creation events (Sysmon Event ID 1) where the parent is nppSetup*.exe and the child is powershell.exe, then inspect the command line for subexpression syntax
- Alert on PowerShell command lines invoked by any NSIS installer that contain $(, backticks, or ; within quoted path arguments
- Correlate MSIX registration activity with subsequent unexpected child processes originating from powershell.exe
Monitoring Recommendations
- Enable PowerShell Script Block Logging (Event ID 4104) to capture the fully expanded command executed by the installer
- Ingest Windows process creation logs (Event ID 4688) with full command-line auditing enabled
- Review software deployment pipelines and MDM/EDR telemetry for Notepad++ installer versions prior to 8.9.7
How to Mitigate CVE-2026-73250
Immediate Actions Required
- Upgrade Notepad++ to version 8.9.7 or later using the official installer from the v8.9.7 release page
- Audit existing Notepad++ deployments and identify any installations performed into non-standard directories
- Restrict who can execute installers with elevated privileges on shared or multi-user Windows systems
Patch Information
The fix is delivered in Notepad++ 8.9.7. Commit 3764d5b7 modifies nppSetup.nsi to pass $INSTDIR through the NPP_INSTDIR environment variable and reference it in PowerShell as $env:NPP_INSTDIR. This prevents NSIS from interpolating the path into the PowerShell command string, blocking subexpression evaluation of attacker-controlled path components.
Workarounds
- Install Notepad++ only into default paths such as C:\Program Files\Notepad++ that do not contain shell metacharacters
- Deselect the context menu component during installation to skip the vulnerable RegisterMSIX code path
- Deploy Notepad++ via managed software distribution with vetted installation paths until upgrading to 8.9.7
# Verify installed Notepad++ version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "Notepad++*" } |
Select-Object DisplayName, DisplayVersion, InstallLocation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
