Skip to content
OpenAdvisories

Product · shd101wyy

vscode-markdown-preview-enhanced

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.3
    CVE-2026-54702

    Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler

    Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _c…

    shd101wyy vscode-markdown-preview-enhanced
  • High 8.5
    CVE-2026-54566

    Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`

    Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a …

    shd101wyy vscode-markdown-preview-enhanced
  • High 8.8
    CVE-2026-54525

    Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows

    Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.ex…

    shd101wyy vscode-markdown-preview-enhanced