They also introduced a critical security vulnerability into notepad where they just had the markdown links shell execute open link which allowed just installing arbitrary software as long as the link was valid instead of just opening a browser.

If you managed to get the file onto a person's you could execute it by having the person click on the link.