alt Hacker NewsI believe Markdown support is what led to CVE-2026-20841 earlier this month.
20260211 https://news.ycombinator.com/item?id=46971516 Windows Notepad App Remote Code Execution Vulnerability (804 points, 516 comments)
20260210 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
> "An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad"
Other recent Notepad issues:
20260207 https://news.ycombinator.com/item?id=46927098 Microsoft account bugs locked me out of Notepad – Are thin clients ruining PCs? (187 points, 284 comments)
20260127 https://news.ycombinator.com/item?id=46780451 Windows 11 January Update Breaks Notepad (60 points, 25 comments)
Replies
It was already true that an attacker could trick a user into copying a malicious link inside a file opened in Notepad to their browser, was that also a Remote Code Execution Vulnerability?
This is my favorite part of this story. Do you want remote code execution? Because [fixing things that aren't broken] is how you get remote code execution.