SecureWithUmer/CVE-2026-20841

PoC

PoC for a remote code execution flaw in Windows Notepad's markdown renderer. The markdown engine does not restrict URL protocols, allowing arbitrary protocol handlers to be triggered via clickable links

view exploit source poc_in_githubauthor SecureWithUmerpublished 2026-02-12catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-20841US	—	9.01% (95th)	Exploit	2026-02-10
Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan