I can confirm it works fine in Content Editor Web Part. Just tried this code:
<script>
MyObject = new ActiveXObject("WScript.Shell");
function RunNotepad()
{
MyObject.Run("C:\\Windows\\system32\\notepad.exe");
return true;
}
</script>
<input onclick="return RunNotepad()" type="button" value="Run Notepad"/>
As long as we are discussing SharePoint Online, your SP addresses should already be included in one of IE's security zones. I've got 4 https://{site}.sharepoint.com
entries in Trusted
zone, but you may want to take a look at In what Security Zone should SharePoint Online (Office 365) be added? or search for official recommendations from Microsoft.
Then I've opened IE
-> Tools
-> Internet Options
-> Security
tab, selected Trusted
zone, pressed Custom level...
and set ActiveX-related options to Prompt
. Now at the page load I see this:
notepad
is launched fine from that button now.
So you see there is nothing SP-related here - it's IE security restrictions in action. Adjust your security zone settings, and script will work 100%. But stay informed that it lowers overall security.