{"id":"CVE-2026-20841","aliases":["EUVD-2026-7307","GHSA-9w4f-2qq2-5rc9"],"status":"published","title":"Windows Notepad App Remote Code Execution Vulnerability","description":"Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.08877,"percentile":0.95291,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2026-02-10T17:51:50Z","modified":"2026-08-19T16:26:21Z","exploits":[{"source":"pocgithub","id":"hamzamalik3461/CVE-2026-20841","title":"hamzamalik3461/CVE-2026-20841","date":"2024-09-22","url":"https://github.com/hamzamalik3461/CVE-2026-20841"},{"source":"pocgithub","id":"BTtea/CVE-2026-20841-PoC","title":"BTtea/CVE-2026-20841-PoC","date":"2026-02-11","url":"https://github.com/BTtea/CVE-2026-20841-PoC"},{"source":"pocgithub","id":"RajaUzairAbdullah/CVE-2026-20841","title":"RajaUzairAbdullah/CVE-2026-20841","date":"2026-02-11","url":"https://github.com/RajaUzairAbdullah/CVE-2026-20841"},{"source":"pocgithub","id":"tangent65536/CVE-2026-20841","title":"tangent65536/CVE-2026-20841","date":"2026-02-11","url":"https://github.com/tangent65536/CVE-2026-20841"},{"source":"pocgithub","id":"SecureWithUmer/CVE-2026-20841","title":"SecureWithUmer/CVE-2026-20841","date":"2026-02-12","url":"https://github.com/SecureWithUmer/CVE-2026-20841"},{"source":"pocgithub","id":"atiilla/CVE-2026-20841","title":"atiilla/CVE-2026-20841","date":"2026-02-12","url":"https://github.com/atiilla/CVE-2026-20841"},{"source":"pocgithub","id":"dogukankurnaz/CVE-2026-20841-PoC","title":"dogukankurnaz/CVE-2026-20841-PoC","date":"2026-02-12","url":"https://github.com/dogukankurnaz/CVE-2026-20841-PoC"},{"source":"pocgithub","id":"hackfaiz/CVE-2026-20841-PoC","title":"hackfaiz/CVE-2026-20841-PoC","date":"2026-02-12","url":"https://github.com/hackfaiz/CVE-2026-20841-PoC"},{"source":"pocgithub","id":"patchpoint/CVE-2026-20841","title":"patchpoint/CVE-2026-20841","date":"2026-02-12","url":"https://github.com/patchpoint/CVE-2026-20841"},{"source":"pocgithub","id":"uky007/CVE-2026-20841_notepad_analysis","title":"uky007/CVE-2026-20841_notepad_analysis","date":"2026-02-12","url":"https://github.com/uky007/CVE-2026-20841_notepad_analysis"},{"source":"pocgithub","id":"EleniChristopoulou/PoC-CVE-2026-20841","title":"EleniChristopoulou/PoC-CVE-2026-20841","date":"2026-02-17","url":"https://github.com/EleniChristopoulou/PoC-CVE-2026-20841"},{"source":"pocgithub","id":"404godd/CVE-2026-20841-PoC","title":"404godd/CVE-2026-20841-PoC","date":"2026-02-26","url":"https://github.com/404godd/CVE-2026-20841-PoC"},{"source":"pocgithub","id":"whiskeylab/notepad_CVE_2026_20841","title":"whiskeylab/notepad_CVE_2026_20841","date":"2026-04-07","url":"https://github.com/whiskeylab/notepad_CVE_2026_20841"},{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-20841","title":"ashrafzaryouh/CVE-2026-20841","date":"2026-06-01","url":"https://github.com/ashrafzaryouh/CVE-2026-20841"}],"products":[{"vendor":"microsoft","product":"windows notepad"},{"vendor":"microsoft","product":"windows_notepad"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841","tags":["vendor-advisory","patch","Vendor Advisory"]},{"url":"https://news.ycombinator.com/item?id=46971516","tags":["Issue Tracking"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20841"},{"url":"https://github.com/advisories/GHSA-9w4f-2qq2-5rc9"}],"sources":{"cve":[{"id":"CVE-2026-20841","title":"Windows Notepad App Remote Code Execution Vulnerability","description":"Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.","status":"published","published":"2026-02-10T17:51:50.412Z","modified":"2026-08-19T16:26:21.209Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T13:35:44.571002Z"}],"euvd":[{"id":"EUVD-2026-7307","description":"Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.","status":"published","published":"2026-02-10T17:51:50Z","modified":"2026-08-19T16:26:21Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T18:01:44.172516Z"}],"ghsa":[{"id":"GHSA-9w4f-2qq2-5rc9","title":"Improper neutralization of special elements used in a command ('command injection') in Windows...","description":"Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code over a network.","status":"published","published":"2026-02-10T18:30:40Z","modified":"2026-02-11T15:31:25Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:06:09.03825Z"}],"nvd":[{"id":"CVE-2026-20841","description":"Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.","status":"published","published":"2026-02-10T18:16:22.643Z","modified":"2026-06-17T10:17:53.867Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:12:05.52517Z"}]}}