An unsafe search path flaw (CWE-426) exists in Notepad++ versions earlier than 8.9.2. When launching Windows Explorer without specifying an absolute executable path, the application may execute a malicious explorer.exe if an attacker can control the process working directory. This can result in arbitrary code execution within the context of the running Notepad++ process, jeopardizing the confidentiality and integrity of user data.

The vulnerability affects Notepad++ for Windows released before version 8.9.2. All earlier editions are susceptible because they do not validate the path used to invoke explorer.exe.

The CVSS score of 7.3 indicates a medium‑high risk, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The risk is not currently listed in the CISA KEV catalog. Likely attack conditions require the attacker to have local access or influence over the working directory used by Notepad++; once that is achieved, launching the editor can trigger execution of a malicious explorer.exe. The threat is most pronounced for users running older builds on shared or multi‑user systems where directory contents may be manipulated.