hamzamalik3461/cve-2026-20841🛠 Demonstrate remote code execution in Windows Notepad via markdown links exploiting unsecured URL protocols.
CVE-2026-20841 is a known security weakness in the Windows Notepad application. It affects the markdown feature, which lets Notepad display formatted text with clickable links. This weakness happens because the markdown engine running inside Notepad does not limit the types of links (called URL protocols) it allows. This means an attacker can create a link that, when clicked, causes Notepad to run programs or commands that the user did not intend to run.
This tool provides a Proof of Concept (PoC) to show how this security flaw works. It helps security researchers and technology experts learn how the vulnerability works and test if systems are at risk.
This project is designed for people who want to:
No programming skills are required to run this software. It is best used by IT professionals or curious users who want to check their Windows devices.
Before you use this software, make sure your computer fits these requirements:
The test tool may need permission to run programs on your PC. You might see Windows Defender or antivirus warnings. This is normal because the tool simulates how real attacks could work.
You should only run the tool on computers you own or have permission to test.
To get the software, do the following:
Go to the release page.
Click this big button to visit the downloads area:
Choose the latest release on the page.
Look for the file that fits your system (usually a .exe or .zip file).
Download the file.
Click the file name link to start downloading.
Run or Unpack the software.
.exe file, double-click it to run..zip file, right-click and choose “Extract All,” then open the folder and double-click the .exe inside.After installation, you will see a simple window with instructions. Here is how to proceed:
The tool creates a fake markdown file containing links that use unusual URL handlers. Normally, these links should not open programs without permission. But because of CVE-2026-20841, Notepad does not block them.
When you run the test, the software tries to open these links in Notepad. If it succeeds, Notepad is vulnerable and can let attackers run harmful code.
To keep testing accuracy, download new versions when available:
If you encounter problems, you can:
This tool shows how hackers could use security flaws. Use it responsibly:
This project relates to:
You can start testing now by visiting the downloads page:
Download CVE-2026-20841 Tool