On February 10, 2026, Microsoft announced the existence of CVE-2026-20841, a command injection vulnerability related to the rendering of Markdown links in Notepad. While they claim to have fixed it, I think their fix completely missed the point of the vulnerability. To that end, let's take a look at the fix and how an attacker could work around it.