Executive Summary

Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code over a network.

The modern Windows Notepad app (distributed via Microsoft Store) introduced Markdown rendering support, which includes clickable hyperlinks. The vulnerability exists because Notepad fails to properly validate and sanitize URI schemes within Markdown links before processing them. An attacker can craft a malicious .md file containing specially formed links that, when clicked by the user, trigger unverified protocol handlers to load and execute remote content.

CVSS v3.1 Metrics

Base Metrics

Temporal Metrics

FAQ

How could an attacker exploit this vulnerability?

An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

What is the target context of the remote code execution?

According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). The malicious code would execute in the security context of the user who opened the Markdown file, giving the attacker the same permissions as that user.

Attack Scenario

1. Attacker crafts a Markdown (.md) file containing malicious hyperlinks.
2. The victim opens the file in the vulnerable version of Windows Notepad.
3. Notepad renders the Markdown and displays clickable links.
4. When the victim clicks the link, Notepad processes the URI without proper validation.
5. This triggers protocol handlers (e.g., ms-appinstaller://) that can fetch and execute remote payloads, or file:// URIs that can directly launch local executables.
6. The malicious code runs with the same privileges as the logged-in user.

Proof of Concept

Disclaimer: This proof of concept is provided strictly for educational and authorized security research purposes only. Do not use this against systems you do not own or have explicit written permission to test. Unauthorized access to computer systems is illegal and punishable by law.

The PoC demonstrates two attack vectors through crafted Markdown links:

Vector 1 - Remote payload installation via protocol handler abuse:

Vector 2 - Local executable invocation via file URI:

Demo

Remediation

• Update Windows Notepad to build 11.2510 or later via the Microsoft Store.
• Enable automatic app updates in Windows Settings > Apps > Microsoft Store.
• Do not open .md files from untrusted sources in Notepad.
• Do not click links within Markdown files received via email or untrusted downloads.

References

• MSRC - CVE-2026-20841
• NVD - CVE-2026-20841
• CVE.org - CVE-2026-20841

Legal Disclaimer

The information provided in this repository is for educational and authorized security research purposes only. This proof of concept is shared to help defenders understand and mitigate the vulnerability. The author is not responsible for any misuse of the information or tools provided here. Always obtain proper written authorization before testing for vulnerabilities on any system. Unauthorized access to computer systems is a criminal offense in most jurisdictions. Use responsibly and ethically.