Thread context
2 posts in path
Parent
@pheonix@hachyderm.io
Open
@pheonix@hachyderm.io
They finally did it. Microsoft has successfully over-engineered a text editor into a threat vector. This CVE is an 8.8 severity RCE in Notepad of all things lmao. Apparently, the "innovation" of addin
:platypush: #Automation addict @ #Platypush 🔧 Main developer @ GPSTracker, Madblog, Webmentions, Pubby... :booking: Senior engineer (data & ML) @ Booking.com 🇵🇸 Creator of the #Gaza archive ( gaza.onl ), part of the #GazaVerified family 🌐 #Indieweb contributor, #ActivityPub and #Webmentions enthusiast 🤖 #AI builder (when ethical and local) 🔓 Compulsive #FOSS contributor :arch: Prone to unsolicited "btw I use #Arch " statements 🏡 #SelfHost all #tech ! 🔬 Open #science and open #data activist 🎶 #Music geek 🎸 #Guitarist 🛹️ #Skater 🏄 #Surfer 🚲 Brains travel on #bike 👪 #Dad of a small geek ⭐ (Allegedly) pragmatic #socialist ✊ Partisan blood. The only good fascist is a dead one ☀️ #Climate change is real. We owe our children a better world 🇪🇺 Proud European who wants things to be improved together 🇺🇦 🇵🇸 🇸🇩 🇹🇼 Self-determination and support for all the oppressed 🔎 #searchable 🇮🇹 ⇒ 🇳🇱
manganiello.eu
:platypush: #Automation addict @ #Platypush 🔧 Main developer @ GPSTracker, Madblog, Webmentions, Pubby... :booking: Senior engineer (data & ML) @ Booking.com 🇵🇸 Creator of the #Gaza archive ( gaza.onl ), part of the #GazaVerified family 🌐 #Indieweb contributor, #ActivityPub and #Webmentions enthusiast 🤖 #AI builder (when ethical and local) 🔓 Compulsive #FOSS contributor :arch: Prone to unsolicited "btw I use #Arch " statements 🏡 #SelfHost all #tech ! 🔬 Open #science and open #data activist 🎶 #Music geek 🎸 #Guitarist 🛹️ #Skater 🏄 #Surfer 🚲 Brains travel on #bike 👪 #Dad of a small geek ⭐ (Allegedly) pragmatic #socialist ✊ Partisan blood. The only good fascist is a dead one ☀️ #Climate change is real. We owe our children a better world 🇪🇺 Proud European who wants things to be improved together 🇺🇦 🇵🇸 🇸🇩 🇹🇼 Self-determination and support for all the oppressed 🔎 #searchable 🇮🇹 ⇒ 🇳🇱
manganiello.eu
@fabio@manganiello.eu
·
Feb 11, 2026
@pheonix@hachyderm.io the thing is that there are many, many safe existing libraries to properly render and parse #Markdown without exposing yourself to RCE.
But my guess is that some project manager at #Microsoft simply went like “nah, I don’t want to wrestle with those licensing issues - just implement a Markdown parser/renderer from scratch, with this over-stretched team of 3 contractors, and get it done by the end of the quarter”.
View full thread on manganiello.eu