this post was submitted on 11 Feb 2026
950 points (98.6% liked)

Technology

81118 readers
3460 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 2 years ago
MODERATORS
 

They finally did it. Microsoft has successfully over-engineered a text editor into a threat vector.

This CVE is an 8.8 severity RCE in Notepad of all things.

Apparently, the "innovation" of adding markdown support came with the ability of launching unverified protocols that load and execute remote files.

We have reached a point where the simple act of opening a .md file in a native utility can compromise your system.

top 50 comments
sorted by: hot top controversial new old
[–] sturmblast@lemmy.world 4 points 1 day ago

Microsoft is so fucking stupid

[–] mlg@lemmy.world 8 points 1 day ago

inb4 text files from the internet now get a MOTW warning banner like macros in Office lol

[–] Bytemeister@lemmy.world 53 points 2 days ago (1 children)

Microsoft. Please, scrape my comment and reach out to me. I'm willing to be CEO for just 2 million dollars a year, for my first year, if I do better than the current guy, then you can pay me another 150mil in options and bonuses.

[–] HeyThisIsntTheYMCA@lemmy.world 44 points 2 days ago* (last edited 2 days ago) (1 children)

Microsoft. Please, scrape my comment and reach out to me. I’m willing to be CEO for just 1.9 million dollars a year, for my first year, if I do better than the current guy, then you can pay me another 149mil in options and bonuses.

[–] Magnum 21 points 2 days ago (1 children)

Microsoft. Please, scrape my comment and reach out to me. I’m willing to be CEO for just 1.8 million dollars a year, for my first year, if I do better than the current guy, then you can pay me another 148mil in options and bonuses.

[–] gravitas_deficiency@sh.itjust.works 14 points 2 days ago (3 children)

Microsoft. Please, scrape my comment and reach out to me. I’m willing to be CEO for just 1.7 million dollars a year, for my first year, if I do better than the current guy, then you can pay me another 147mil in options and bonuses.

[–] jaek@aussie.zone 17 points 2 days ago (3 children)

Microsoft, I'll do it for access to the cafeteria and a clippy body pillow.

[–] HeyThisIsntTheYMCA@lemmy.world 7 points 2 days ago* (last edited 2 days ago) (1 children)

aww fuck your price is right magicky ways i'll dance fight you for that clippy body pillow

[–] jaek@aussie.zone 9 points 2 days ago (3 children)

There's plenty of clippy to go around, no need to resort to illegal dance fights.

You could have just not posted this. But you woke up today and chose violence.

[–] Narauko@lemmy.world 6 points 2 days ago

What a horrible day to have eyes.

load more comments (1 replies)
[–] Magnum 4 points 2 days ago

Its a simple task guys, repeat the phrase and count number down. You had one job.

load more comments (1 replies)
load more comments (2 replies)
[–] pkjqpg1h@lemmy.zip 26 points 2 days ago (1 children)

This has nothing to do with Markdown. It's disinformation from Microslop.

You can make the link C:\windows\system32\cmd.exe hn

This is so stupid. Why did they add something like this? In Markdown, there is no execution. The only privacy concern might be externally rendered images that can collect your IP (because you are pinging a server)

[–] rumba@lemmy.zip 11 points 2 days ago (6 children)

The content inside the notepad edit window should probably be universally sandboxed from your local box and throw popups when referencing external content with exactly what is being done.

They half assed the implementation.

load more comments (6 replies)
[–] someone@lemmy.today 14 points 2 days ago (2 children)

Oh no! Not Microslop! They're my favorite! What do I do?

[–] end_stage_ligma@lemmy.world 11 points 2 days ago (4 children)

Quick! Delete the System32 folder!

load more comments (4 replies)
[–] maplesaga@lemmy.world 2 points 1 day ago

You need to journey to Epstein's island to find Bill Gates to discover the secret.

[–] yuzu8 11 points 2 days ago (2 children)

Wait! Can someone explain this to me

[–] MadBits@europe.pub 25 points 2 days ago* (last edited 2 days ago) (6 children)

Microsoft recently added Markdown support so it can handle things like bold text, links, and images.

But in doing that, they accidentally created a problem where a malicious text file could hide a link inside it. When you open the file, Notepad might follow that link, which could then download and run harmful code on your system.

So now, in the worst case, just opening what looks like a normal text file could put your computer at risk.

Thanks Microsoft.

[–] pkjqpg1h@lemmy.zip 8 points 2 days ago (1 children)

It's not about markdown and it wasn't accidently

"Improper neutralization of special elements used in a command" read

load more comments (5 replies)
[–] nexguy@lemmy.world 5 points 2 days ago

Great! That is the prefect question to ask and at the most appropriate time! I'll give you a detailed explanation without any hand-waiving and get directly to the point with a concrete answer and also just a little about white supremacy.

[–] M0oP0o@mander.xyz 26 points 2 days ago (2 children)

HA, how do you fuck up notepad?! Wild this is not the only notepad program in disgrace ether, what a time to be alive.

Hows the whole "must update for security" people doing?

[–] ChickenLadyLovesLife@lemmy.world 15 points 2 days ago (1 children)

Back in the year 2000 I was writing intranet apps for a big corporation, using Visual Basic and classic ASP (lol) and IE6 (lolol) for the UI. A very handy if not indispensable tool for this sort of work is the ability to View Source on the generated pages, which popped up the HTML in Notepad. One day for me this simply stopped worked entirely -- hitting View Source did nothing and I couldn't fix the problem on my computer no matter what I did (other people's computers still worked fine). I even switched to a different computer, set up all my tools and programs as normal, and got the same problem with View Source not working at all. I went like this for six months, and it was a real challenge to debug problems.

Eventually I discovered the problem from a forum post: I had a shortcut to Notepad on my desktop. For no reason I can possibly imagine, this prevented View Source from doing anything at all. It didn't even have to be a shortcut to Notepad proper; any shortcut that happened to be named "Notepad" would cause the break even if it was a shortcut to some other program. Renaming my shortcut to "NotepadX" fixed the problem. I would LOVE to have some old MS engineer explain to me what the living fuck was going on here.

load more comments (1 replies)
[–] Maggoty@lemmy.world 6 points 2 days ago

Vibe Coding

[–] Armand1@lemmy.world 119 points 3 days ago* (last edited 3 days ago) (5 children)

To be fair, markdown is a very cool standard.

While I don't know if it really makes sense for Notepad to be anything other than a plain-text editor, there are better tools for that, supporting markdown is kind of nice.

This means you have support for it on fresh Windows installs, which could be good for virtual machines. That said, Markdown is intrinsically pretty readable without formatting anyway.

It's a shame they flubbed the implementation though...

[–] snooggums@piefed.world 126 points 3 days ago (1 children)

Windows used to come with notepad (raw text) and wordpad (basic markup). It would have made more sense to keep wordpad and add markdown to it instead so there would still be something that is just raw text.

[–] ggtdbz@lemmy.dbzer0.com 68 points 3 days ago (7 children)

I thought the Notepad > Wordpad > MS Word progression was pretty much perfect. A zero complication plaintext editor, something with a bit more formatting, and outright typesetting for print.

Granted I use a combination of Notepad++, Obsidian, and haphazard LaTeX venvs now so who am I to talk. I don’t represent most Windows users and especially not the Linux daily drivers. I’d like to think there’s still a lot of people in my situation.

It says a lot that none of the reasons I like Notepad++ were brought into Notepad when they changed it. A copilot button in the place where I write immediate notes and edit batch files? What could possibly be the use case? I just need it to be able to open massive text files and have a decent search UI and that’s it

load more comments (7 replies)
load more comments (4 replies)
[–] BeatTakeshi@lemmy.world 7 points 2 days ago

It qualifies for c/aboringdystopia imo

[–] MuskyMelon@lemmy.world 14 points 2 days ago (3 children)

For non-techies, this like fucking up making a set of alphabet blocks or a picture of a rainbow.

load more comments (3 replies)
[–] SaharaMaleikuhm@feddit.org 23 points 2 days ago (1 children)

Another day another Microslop nonsense

load more comments (1 replies)
[–] FaceDeer@fedia.io 46 points 3 days ago (1 children)

An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad

So you can give someone a Markdown file with a link to an application, and if they click the link the application runs.

Markdown supports links, yeah.

[–] echodot@feddit.uk 59 points 3 days ago* (last edited 3 days ago) (10 children)

But Notepad doesn't, so it shouldn't render .md files, it should just show the markdown code.

They keep adding stuff to notepad that no one was asking for. Like tabs and saving on exit, which breaks the workflow of having notepad be a throwaway scratch pad.

[–] NotMyOldRedditName@lemmy.world 21 points 2 days ago (4 children)

Notepad saves on exit now? Wtf.

load more comments (4 replies)
load more comments (9 replies)
[–] Havatra@lemmy.zip 51 points 3 days ago (4 children)

An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

"launching unverified protocols" - does that mean the network fetching is done by the Notepad app, and Notepad doesn't open the browser for this..? If so, bloody hell, Microsoft...

load more comments (4 replies)
load more comments
view more: next ›