Remember when Notepad was just… Notepad? A simple text editor nobody asked to be modernized?

Yeah, Microsoft didn’t care either. They bolted on Markdown support and AI features anyway. And now we’ve got CVE-2026-20841. Remote code execution. Via a text file. This is the kind of thing that makes you go “oh come on, really?”

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 9 months ago

It uses a more generic shell linking method, that doesn't just load web URLs but also file paths, including to executables.

https://news.ycombinator.com/item?id=46971516

  • source
  • parent