Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00312.

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e cve-icon cve-icon
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323 cve-icon cve-icon
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30 cve-icon cve-icon
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-83c6-hcjv-pvmg cve-icon cve-icon cve-icon
History

Thu, 15 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30.
Title Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler
Weaknesses CWE-749
References
Metrics cvssV4_0

{'score': 7.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-15T16:24:10.781Z

Reserved: 2026-06-15T22:58:06.563Z

Link: CVE-2026-54702

cve-icon Vulnrichment

Updated: 2026-10-15T16:23:49.100Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T20:17:47.737

Modified: 2026-10-16T16:00:33.533

Link: CVE-2026-54702

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T13:45:19Z

Weaknesses