Untrusted input in the installer’s $INSTDIR variable is passed unvalidated to a PowerShell command that registers an MSIX package. An attacker can inject PowerShell subexpression syntax such as $() in the chosen installation path, causing arbitrary commands to be executed in the installer’s security context. The vulnerability, identified as a command injection flaw, may allow the execution of malware or privileged code during the setup process, posing a moderate risk to confidentiality, integrity, and availability of the affected system. The CVSS score, 5.4, reflects the medium severity of the flaw.

Notepad++ for Windows 11, both x64 and ARM64 installers, versions prior to 8.9.7 are affected. The vulnerability is specifically tied to the Windows 11 x64 and ARM64 installers that accept a user‑specified installation directory. Users who installed any of these versions before the 8.9.7 release are potentially exposed.

Because the flaw requires the attacker to control the installation directory during a legitimate software installation, the attack vector is local but only applicable when an installation is performed. The EPSS score, less than 1 percent, indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, further suggesting limited exploitation activity. The CVSS of 5.4, combined with the low EPSS, suggests a moderate risk that can be mitigated by addressing the described issue. The attacker would need to provide a malicious installation path that includes PowerShell subexpression syntax, and the context menu component of the installer must be selected for the injected command to run.