CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Notepad Markdown Link Command Injection Vulnerability (CVE-2026-20841)

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Microsoft has patched a command injection flaw (CVE-2026-20841, CVSS score: 8.8) in Notepad for Windows 11. The vulnerability allows remote code execution when users click malicious links in Markdown files. The flaw was exploited by creating Markdown files with 'file://' links to executable files or special URIs to run arbitrary payloads. The issue was fixed in the February 2026 Patch Tuesday update. The vulnerability could execute code in the context of the user opening the Markdown file, granting attackers the same permissions as that user.

Timeline

  1. 12.02.2026 13:51 1 articles · 11h ago

    Microsoft Patches Notepad Command Injection Flaw (CVE-2026-20841)

    Microsoft has addressed a critical command injection vulnerability in Notepad that could lead to remote code execution. The flaw was exploited via malicious Markdown links and has been fixed in the February 2026 Patch Tuesday update.

    Show sources
    Open in new tab

Information Snippets