You can infect your PC with malware without ever leaving Notepad, thanks to recent updates and additions. Hooray.
Users could be tricked into running arbitrary code, but the issue was patched last week.