They finally did it. Microsoft has successfully over-engineered a text editor into a threat vector.

This CVE is an 8.8 severity RCE in Notepad of all things.

Apparently, the "innovation" of adding markdown support came with the ability of launching unverified protocols that load and execute remote files.

We have reached a point where the simple act of opening a .md file in a native utility can compromise your system.

top 50 comments

sorted by: hot top controversial new old
[–] 123 points 8 months ago* (13 children)

To be fair, markdown is a very cool standard.

While I don't know if it really makes sense for Notepad to be anything other than a plain-text editor, there are better tools for that, supporting markdown is kind of nice.

This means you have support for it on fresh Windows installs, which could be good for virtual machines. That said, Markdown is intrinsically pretty readable without formatting anyway.

It's a shame they flubbed the implementation though...

  • source
  • hideshow 13 child comments
  • [–] 131 points 8 months ago (8 children)

    Windows used to come with notepad (raw text) and wordpad (basic markup). It would have made more sense to keep wordpad and add markdown to it instead so there would still be something that is just raw text.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 70 points 8 months ago (7 children)

    I thought the Notepad > Wordpad > MS Word progression was pretty much perfect. A zero complication plaintext editor, something with a bit more formatting, and outright typesetting for print.

    Granted I use a combination of Notepad++, Obsidian, and haphazard LaTeX venvs now so who am I to talk. I don’t represent most Windows users and especially not the Linux daily drivers. I’d like to think there’s still a lot of people in my situation.

    It says a lot that none of the reasons I like Notepad++ were brought into Notepad when they changed it. A copilot button in the place where I write immediate notes and edit batch files? What could possibly be the use case? I just need it to be able to open massive text files and have a decent search UI and that’s it

  • source
  • parent
  • hideshow 7 child comments
  • load more comments (5 replies)
  • load more comments (4 replies)
    [–] 57 points 8 months ago (13 children)

    Microsoft. Please, scrape my comment and reach out to me. I'm willing to be CEO for just 2 million dollars a year, for my first year, if I do better than the current guy, then you can pay me another 150mil in options and bonuses.

  • source
  • hideshow 13 child comments
  • [–] 46 points 8 months ago* (12 children)

    Microsoft. Please, scrape my comment and reach out to me. I’m willing to be CEO for just 1.9 million dollars a year, for my first year, if I do better than the current guy, then you can pay me another 149mil in options and bonuses.

  • source
  • parent
  • hideshow 12 child comments
  • [–] 21 points 8 months ago (11 children)

    Microsoft. Please, scrape my comment and reach out to me. I’m willing to be CEO for just 1.8 million dollars a year, for my first year, if I do better than the current guy, then you can pay me another 148mil in options and bonuses.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 14 points 8 months ago (10 children)

    Microsoft. Please, scrape my comment and reach out to me. I’m willing to be CEO for just 1.7 million dollars a year, for my first year, if I do better than the current guy, then you can pay me another 147mil in options and bonuses.

  • source
  • parent
  • hideshow 10 child comments
  • load more comments (2 replies)
  • [–] 56 points 8 months ago (4 children)

    An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

    "launching unverified protocols" - does that mean the network fetching is done by the Notepad app, and Notepad doesn't open the browser for this..? If so, bloody hell, Microsoft...

  • source
  • hideshow 4 child comments
  • [–] 22 points 8 months ago (3 children)

    As I understood it, there can be specifically crafted links in Markdown documents, which, when clicked, will download a file and then execute it.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 26 points 8 months ago (2 children)

    RCE means exactly this, the ability to run any code on a remote device (the one running notepad).

    It's a parsing issue. I've encountered the same writing an MD parser for a website, not as trivial to solve as it seems. For a multi billion dollar company this is hilariously stupid. Why do I get the feeling someone vibecoded this entire implementation.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 12 points 8 months ago (1 child)
  • [–] 9 points 8 months ago

    They admitted, IIRC, that they fired a bunch of devs and then used gen-AI to write code. I think I have a comment from last year around this time that this was gonna happen, including data breaches on a massive scale, when companies were openly touting this tactic. It's only getting started.

  • source
  • parent
  • [–] 46 points 8 months ago (15 children)

    An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad

    So you can give someone a Markdown file with a link to an application, and if they click the link the application runs.

    Markdown supports links, yeah.

  • source
  • hideshow 15 child comments
  • [–] 60 points 8 months ago* (14 children)

    But Notepad doesn't, so it shouldn't render .md files, it should just show the markdown code.

    They keep adding stuff to notepad that no one was asking for. Like tabs and saving on exit, which breaks the workflow of having notepad be a throwaway scratch pad.

  • source
  • parent
  • hideshow 14 child comments
  • [–] 9 points 8 months ago* (2 children)

    Funnily enough, you used as an example the only new feature I actually like and rely on. I use it for things like PWs for shared service accounts (dont @ me, I know it's bad practice and our org does have a pw manager but these accounts aren't managed by it and I am not in control of them)

    Also useful for things that are needed temporarily but I dont know how long that 'temporary' is going to be.

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (2 replies)
  • [–] 9 points 8 months ago* (2 children)

    Fucking hell i have notepad++ for that shit.

    Average users don't need that functionality , and those that do already don't use notepad for it

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (3 replies)
  • [+] 28 points 8 months ago* (last edited 5 months ago) (7 children)
  • [–] 26 points 8 months ago (6 children)

    HA, how do you fuck up notepad?! Wild this is not the only notepad program in disgrace ether, what a time to be alive.

    Hows the whole "must update for security" people doing?

  • source
  • hideshow 6 child comments
  • [–] 16 points 8 months ago (4 children)

    Back in the year 2000 I was writing intranet apps for a big corporation, using Visual Basic and classic ASP (lol) and IE6 (lolol) for the UI. A very handy if not indispensable tool for this sort of work is the ability to View Source on the generated pages, which popped up the HTML in Notepad. One day for me this simply stopped worked entirely -- hitting View Source did nothing and I couldn't fix the problem on my computer no matter what I did (other people's computers still worked fine). I even switched to a different computer, set up all my tools and programs as normal, and got the same problem with View Source not working at all. I went like this for six months, and it was a real challenge to debug problems.

    Eventually I discovered the problem from a forum post: I had a shortcut to Notepad on my desktop. For no reason I can possibly imagine, this prevented View Source from doing anything at all. It didn't even have to be a shortcut to Notepad proper; any shortcut that happened to be named "Notepad" would cause the break even if it was a shortcut to some other program. Renaming my shortcut to "NotepadX" fixed the problem. I would LOVE to have some old MS engineer explain to me what the living fuck was going on here.

  • source
  • parent
  • hideshow 4 child comments
  • load more comments (4 replies)
  • load more comments (1 reply)
    [–] 25 points 8 months ago (1 child)

    Another day another Microslop nonsense

  • source
  • hideshow 1 child comment
  • load more comments (1 reply)
    [–] 21 points 8 months ago*

    Lol. Your second sentence should be the headline of this news.

  • source
  • [–] 16 points 8 months ago (12 children)

    Oh no! Not Microslop! They're my favorite! What do I do?

  • source
  • hideshow 12 child comments
  • load more comments (2 replies)
    [–] 16 points 8 months ago (17 children)

    I miss oldskool Notepad being present on the system. Win11 Notepad is a worthless piece of shit.
    But ... any computer or vm that I use for more than a few hours gets a copy of Metapad.

    I've been using Metapad for ... umm ... decades.
    Metapad is a simple, extremely lightweight editor, intended to just barely be better than Notepad, fixes a lot of shit that MS never did and stays simple.
    https://liquidninja.com/metapad/

  • source
  • hideshow 17 child comments
  • [–] 12 points 8 months ago (8 children)

    I've been a long time user of Notepad++ after Notepad started inserting random whitespace characters in files, which messed up some jankety scripting I was doing at the time. Do you happen to know if Metapad is good about not adding unintended characters like that?

  • source
  • parent
  • hideshow 8 child comments
  • [–] 9 points 8 months ago (2 children)

    Yes. Metapad is too dumb for that shit. By design.
    It's only barely smart enough to be better than Notepad.
    It's not smart enough to do anything dumb.

    Its free, extremely mature, and you already know how to use it.
    Metapad is a feature-for-feature drop-in replacement for Notepad.

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (1 reply)
  • load more comments (5 replies)
  • load more comments (8 replies)
    [–] 15 points 8 months ago (3 children)

    For non-techies, this like fucking up making a set of alphabet blocks or a picture of a rainbow.

  • source
  • hideshow 3 child comments
  • load more comments (3 replies)
    [–] 12 points 8 months ago

    Microslop leads to macroflop.

  • source
  • [–] 12 points 8 months ago (10 children)

    Wait! Can someone explain this to me

  • source
  • hideshow 10 child comments
  • [–] 26 points 8 months ago* (7 children)

    Microsoft recently added Markdown support so it can handle things like bold text, links, and images.

    But in doing that, they accidentally created a problem where a malicious text file could hide a link inside it. When you open the file, Notepad might follow that link, which could then download and run harmful code on your system.

    So now, in the worst case, just opening what looks like a normal text file could put your computer at risk.

    Thanks Microsoft.

  • source
  • parent
  • hideshow 7 child comments
  • load more comments (7 replies)
  • load more comments (2 replies)
    [–] 11 points 8 months ago (1 child)

    It sounds like a link can be a file path and clicking the link just opens the file. If that's the case, this is effectively the same risk as filesystem shortcuts.

  • source
  • hideshow 1 child comment
  • load more comments (1 reply)
    [–] 10 points 8 months ago

    Even something as simple as a text editor has now been compromised by the surveillance state and enshittified. smh.

  • source
  • [–] 9 points 8 months ago

    inb4 text files from the internet now get a MOTW warning banner like macros in Office lol

  • source
  • [–] 8 points 8 months ago (4 children)
    load more comments (4 replies)
    load more comments
    view more: next ›