I read the bug as notepad can launch unsafe links by delegating them to the OS to open.