1008
A remote code execution vulnerability has been found in Microslop Notepad (msrc.microsoft.com)
submitted 8 months ago by to c/technology@lemmy.world
127 comments fedilink hide all child comments
 

They finally did it. Microsoft has successfully over-engineered a text editor into a threat vector.

This CVE is an 8.8 severity RCE in Notepad of all things.

Apparently, the "innovation" of adding markdown support came with the ability of launching unverified protocols that load and execute remote files.

We have reached a point where the simple act of opening a .md file in a native utility can compromise your system.

you are viewing a single comment's thread
view the rest of the comments
[–] 60 points 8 months ago* (14 children)

But Notepad doesn't, so it shouldn't render .md files, it should just show the markdown code.

They keep adding stuff to notepad that no one was asking for. Like tabs and saving on exit, which breaks the workflow of having notepad be a throwaway scratch pad.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 14 child comments
    •
  • [–] 22 points 8 months ago (4 children)

    Notepad saves on exit now? Wtf.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 8 months ago (2 children)

    dude, Notepad even has Copilot now

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 9 points 8 months ago* (2 children)

    Fucking hell i have notepad++ for that shit.

    Average users don't need that functionality , and those that do already don't use notepad for it

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 9 points 8 months ago* (2 children)

    Funnily enough, you used as an example the only new feature I actually like and rely on. I use it for things like PWs for shared service accounts (dont @ me, I know it's bad practice and our org does have a pw manager but these accounts aren't managed by it and I am not in control of them)

    Also useful for things that are needed temporarily but I dont know how long that 'temporary' is going to be.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 8 months ago (1 child)

    keeppassxc for local password manager. More secure and more helpful UI for that very purpose, also can hold your top and let you ctrl-t the current number into to clipboard.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 6 points 8 months ago (2 children)

    Does notepad even have syntax highlighting?

    They should make the web browser render.md. that would be far more useful.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 8 months ago

    My god it's useless. It's the most limited markdown editor in the world. It lacks so much basic function that you would have to download an actual markdown editor if you were ever going to use it, so there's no point in notepad having the functionality, and then at the end of the day it's in a file format that basically doesn't exist outside of the web.

    Microsoft Word cannot open it. So a Microsoft text editor program, can create a file that a different Microsoft text editor program can't read, despite markdown being a supposedly universal standard. Wow.

  • permalink
  • fedilink
  • source
  • parent