CVE-2026-73250

Katalog CVE

CVSS 5.4 · Medium EPSS 0,19%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection'). Skor CVSS 4.0 5.4 (Medium) menurut github.com.

Deskripsi (NVD)

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.

Rincian

Terbit di NVD

11 Agustus 2026

Terakhir diubah

9 September 2026

Status NVD

Awaiting Analysis

CVSS 4.0

5.4 (Medium), sumber github.com
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/notepad-plus-plus/notepad-plus-plus/commit/3764d5b72664ef95421bc53bcb204f9b977d346b
• https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.7
• https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-gp2r-262h-9hgf