CVE-2026-54703
MEDIUM 5.8Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS Code user's operating-system privileges, including user configuration, startup, source, and build files. This file-write vulnerability requires a separate webview JavaScript execution path, such as the independently tracked head.html injection and blind command-dispatch weaknesses. This issue is fixed in version 0.8.30.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 23rd percentile
Impact if exploited
5.8CVSS 4.0 · MEDIUM
- ConfidentialityNone
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ✓Privileges: No account or privileges required
- ⚠User interaction: Succeeds with passive user activity
- ✓Complexity: No special conditions — reliably repeatable
- ⚠Requirements: Specific conditions must be present
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-73: : External Control of File Name or Path
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
References and research data (JSON)
All CVSS metrics
- MEDIUM 5.8 v4.0 · CNA Primary
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - MEDIUM 5.8 v4.0 · NVD Secondary
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-82rc-7g3m-2c42 CVE record · GitHub_M · Updated 2026-10-14T19:09:50.323Z
CVE record · CISA-ADP · Updated 2026-10-15T14:21:40.113Z
NVD · CVE-2026-54703 · Updated 2026-10-16T20:02:37.630
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101583 EUVD · EUVD-2026-101583
Technical & other
- https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323 CVE record · GitHub_M · Updated 2026-10-14T19:09:50.323Z
NVD · CVE-2026-54703 · Updated 2026-10-16T20:02:37.630 - https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e CVE record · GitHub_M · Updated 2026-10-14T19:09:50.323Z
NVD · CVE-2026-54703 · Updated 2026-10-16T20:02:37.630 - https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30 CVE record · GitHub_M · Updated 2026-10-14T19:09:50.323Z
NVD · CVE-2026-54703 · Updated 2026-10-16T20:02:37.630