Notepad++ WinGUp Updater Lack of Update Integrity Verification Remote Code Execution Vulnerability (CVE-2025-15556)

# Upgrade Notepad++ silently using Windows Package Manager (winget)
Write-Host 'Upgrading Notepad++ to version 8.8.9 or higher...' -ForegroundColor Cyan
winget upgrade --id Notepad++.Notepad++ --silent --accept-source-agreements --accept-package-agreements

# Block Notepad++ update domain via local hosts file modification
$HostsFile = '$env:windir\System32\drivers\etc\hosts'
$BlockRule = '127.0.0.1 notepad-plus-plus.org'
if (-not (Select-String -Path $HostsFile -Pattern 'notepad-plus-plus.org')) {
    Add-Content -Path $HostsFile -Value '`n# Temporary mitigation for CVE-2025-15556'
    Add-Content -Path $HostsFile -Value $BlockRule
    Write-Host 'Notepad++ update domain has been successfully blocked.' -ForegroundColor Green
}

# Audit script to detect vulnerable Notepad++ installations
$Path = '${env:ProgramFiles}\Notepad++\
otepad++.exe'
if (Test-Path $Path) {
    $InstalledVer = (Get-Item $Path).VersionInfo.ProductVersion
    Write-Host "Current Installed Version: $InstalledVer" -ForegroundColor Yellow
    [version]$CleanedVer = $InstalledVer.Split(' ')
    [version]$RequiredVer = '8.8.9'
    if ($CleanedVer -lt $RequiredVer) {
        Write-Host '[ALERT] Vulnerable Notepad++ version detected! Action required.' -ForegroundColor Red
    } else {
        Write-Host '[SAFE] Notepad++ is running a secure patched version.' -ForegroundColor Green
    }
} else {
    Write-Host 'Notepad++ is not detected in the default installation path.' -ForegroundColor Gray
}