CVE-2026-54702
HIGH 7.3Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30.
Severe if exploited (CVSS 7.3), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 24th percentile
Impact if exploited
7.3CVSS 4.0 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ✓Privileges: No account or privileges required
- ⚠User interaction: Succeeds with passive user activity
- ✓Complexity: No special conditions — reliably repeatable
- ⚠Requirements: Specific conditions must be present
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-749: : Exposed Dangerous Method or Function
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References and research data (JSON)
All CVSS metrics
- HIGH 7.3 v4.0 · CNA Primary
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - HIGH 7.3 v4.0 · NVD Secondary
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-83c6-hcjv-pvmg CVE record · GitHub_M · Updated 2026-10-14T19:13:58.946Z
CVE record · CISA-ADP · Updated 2026-10-15T16:24:10.781Z
NVD · CVE-2026-54702 · Updated 2026-10-16T16:00:33.533
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101585 EUVD · EUVD-2026-101585
Technical & other
- https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323 CVE record · GitHub_M · Updated 2026-10-14T19:13:58.946Z
NVD · CVE-2026-54702 · Updated 2026-10-16T16:00:33.533 - https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e CVE record · GitHub_M · Updated 2026-10-14T19:13:58.946Z
NVD · CVE-2026-54702 · Updated 2026-10-16T16:00:33.533 - https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30 CVE record · GitHub_M · Updated 2026-10-14T19:13:58.946Z
NVD · CVE-2026-54702 · Updated 2026-10-16T16:00:33.533