{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "8.9.7"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6634650414ff91220a4c353b7fe5ad741af0f9f9"
            }
          ],
          "repo": "https://github.com/notepad-plus-plus/notepad-plus-plus",
          "type": "GIT"
        },
        {
          "database_specific": {
            "source": "REFERENCES"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7670296a5c7fdec624e0a45dbde51059a7d735a8"
            }
          ],
          "repo": "https://github.com/notepad-plus-plus/wingup",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-hjxw-84rf-wg5r"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57233.json"
  },
  "details": "Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.",
  "id": "CVE-2026-57233",
  "modified": "2026-08-20T03:30:26.640724736Z",
  "published": "2026-08-17T20:10:37.698Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/releases/tag/v8.9.7"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57233.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-hjxw-84rf-wg5r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57233"
    },
    {
      "type": "FIX",
      "url": "https://github.com/notepad-plus-plus/wingup/commit/7670296a5c7fdec624e0a45dbde51059a7d735a8"
    },
    {
      "type": "FIX",
      "url": "https://github.com/notepad-plus-plus/wingup/pull/106"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction"
}