CyberRota Analysis
AI-GeneratedNotepad++ versions prior to 8.9.7 on Windows 11 x64 and ARM64 are vulnerable due to improper handling of the installation directory, which can be manipulated to execute arbitrary commands through PowerShell. This vulnerability could allow an attacker to execute malicious code with the installer's security context during the installation process. Organizations using affected versions should prioritize updating to version 8.9.7 to mitigate potential risks associated with this flaw.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer's security context when the context menu component is selected. This issue is fixed in version 8.9.7.