Users could be tricked into running arbitrary code, but the issue was patched last week.
Notepad++ 8.9.2 fixes update hijack exploited to deliver malware, patches RCE flaw, and hardens WinGUp security.