Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-54703 (GCVE-0-2026-54703)

Vulnerability from nvd – Published: 2026-10-14 19:09 – Updated: 2026-10-14 19:09

Title

Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation

Summary

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS Code user's operating-system privileges, including user configuration, startup, source, and build files. This file-write vulnerability requires a separate webview JavaScript execution path, such as the independently tracked head.html injection and blind command-dispatch weaknesses. This issue is fixed in version 0.8.30.

Severity

5.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-73 - External Control of File Name or Path

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_CONFIRM
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shd101wyy	vscode-markdown-preview-enhanced	Affected: < 0.8.30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "vscode-markdown-preview-enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.30"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS Code user\u0027s operating-system privileges, including user configuration, startup, source, and build files. This file-write vulnerability requires a separate webview JavaScript execution path, such as the independently tracked head.html injection and blind command-dispatch weaknesses. This issue is fixed in version 0.8.30."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:09:50.323Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-82rc-7g3m-2c42",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-82rc-7g3m-2c42"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30"
        }
      ],
      "source": {
        "advisory": "GHSA-82rc-7g3m-2c42",
        "discovery": "UNKNOWN"
      },
      "title": "Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54703",
    "datePublished": "2026-10-14T19:09:50.323Z",
    "dateReserved": "2026-06-15T22:58:06.563Z",
    "dateUpdated": "2026-10-14T19:09:50.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54702 (GCVE-0-2026-54702)

Vulnerability from nvd – Published: 2026-10-14 19:13 – Updated: 2026-10-14 19:13

Title

Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler

Summary

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-749 - Exposed Dangerous Method or Function

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_CONFIRM
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shd101wyy	vscode-markdown-preview-enhanced	Affected: < 0.8.30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "vscode-markdown-preview-enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.30"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749: Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:13:58.946Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-83c6-hcjv-pvmg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-83c6-hcjv-pvmg"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30"
        }
      ],
      "source": {
        "advisory": "GHSA-83c6-hcjv-pvmg",
        "discovery": "UNKNOWN"
      },
      "title": "Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54702",
    "datePublished": "2026-10-14T19:13:58.946Z",
    "dateReserved": "2026-06-15T22:58:06.563Z",
    "dateUpdated": "2026-10-14T19:13:58.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54701 (GCVE-0-2026-54701)

Vulnerability from nvd – Published: 2026-10-14 19:11 – Updated: 2026-10-14 19:11

Title

Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview

Summary

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_CONFIRM
https://github.com/shd101wyy/crossnote/pull/444	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/crossnote/commit/8c5…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/crossnote/releases/t…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shd101wyy	vscode-markdown-preview-enhanced	Affected: < 0.8.30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "vscode-markdown-preview-enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.30"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:11:51.712Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-mcwg-4j78-qwv3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-mcwg-4j78-qwv3"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/pull/444",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/pull/444"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/commit/8c55a2ba3365712a1caa4abeece0383bc2994d48",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/commit/8c55a2ba3365712a1caa4abeece0383bc2994d48"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/releases/tag/0.9.31",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/releases/tag/0.9.31"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30"
        }
      ],
      "source": {
        "advisory": "GHSA-mcwg-4j78-qwv3",
        "discovery": "UNKNOWN"
      },
      "title": "Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54701",
    "datePublished": "2026-10-14T19:11:51.712Z",
    "dateReserved": "2026-06-15T22:58:06.563Z",
    "dateUpdated": "2026-10-14T19:11:51.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54566 (GCVE-0-2026-54566)

Vulnerability from nvd – Published: 2026-10-14 19:08 – Updated: 2026-10-14 19:45

Title

Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`

Summary

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 19:44 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_CONFIRM
https://github.com/shd101wyy/crossnote/pull/443	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/crossnote/commit/e48…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/crossnote/releases/t…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shd101wyy	vscode-markdown-preview-enhanced	Affected: < 0.8.29

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54566",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T19:44:50.050593Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T19:45:22.736Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jch"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vscode-markdown-preview-enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.29"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:08:43.663Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jch",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jch"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/pull/443",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/pull/443"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2320",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2320"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/commit/e4890d64502e53b717cce0cb73f1a78b244dc640",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/commit/e4890d64502e53b717cce0cb73f1a78b244dc640"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/0d4010988c6ae56a38c6dec4a7509cbd5a7dcb4c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/0d4010988c6ae56a38c6dec4a7509cbd5a7dcb4c"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/releases/tag/0.9.30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/releases/tag/0.9.30"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.29"
        }
      ],
      "source": {
        "advisory": "GHSA-427h-jhpr-8jch",
        "discovery": "UNKNOWN"
      },
      "title": "Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54566",
    "datePublished": "2026-10-14T19:08:43.663Z",
    "dateReserved": "2026-06-15T19:15:27.342Z",
    "dateUpdated": "2026-10-14T19:45:22.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54525 (GCVE-0-2026-54525)

Vulnerability from nvd – Published: 2026-10-14 19:06 – Updated: 2026-10-14 19:06

Title

Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows

Summary

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_CONFIRM
https://github.com/shd101wyy/crossnote/pull/442	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/crossnote/commit/558…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/crossnote/releases/t…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shd101wyy	vscode-markdown-preview-enhanced	Affected: < 0.8.28

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "vscode-markdown-preview-enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.28"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:06:59.440Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-7v6f-3vq6-r373",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-7v6f-3vq6-r373"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/pull/442",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/pull/442"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2318",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2318"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/commit/5588ca2121c3da43fe331575dc5cf4ef347b91ee",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/commit/5588ca2121c3da43fe331575dc5cf4ef347b91ee"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/dcd80281c986293b93d9f1af34ced64dcb230c77",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/dcd80281c986293b93d9f1af34ced64dcb230c77"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/releases/tag/0.9.29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/releases/tag/0.9.29"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28"
        }
      ],
      "source": {
        "advisory": "GHSA-7v6f-3vq6-r373",
        "discovery": "UNKNOWN"
      },
      "title": "Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54525",
    "datePublished": "2026-10-14T19:06:59.440Z",
    "dateReserved": "2026-06-15T18:40:01.651Z",
    "dateUpdated": "2026-10-14T19:06:59.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11422 (GCVE-0-2026-11422)

Vulnerability from nvd – Published: 2026-06-05 20:16 – Updated: 2026-07-14 15:53

Title

Markdown Preview Enhanced 0.8.x Code Injection via WaveDrom Rendering

Summary

Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension's message passing and invoke arbitrary file writes on the local filesystem.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 13:09 UTC

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6106 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	issue-tracking
https://github.com/shd101wyy/crossnote/commit/558…	patch
https://github.com/shd101wyy/vscode-markdown-prev…	patch
https://www.vulncheck.com/advisories/markdown-pre…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
shd101wyy	Markdown Preview Enhanced	Affected: 0 , < 0.8.27 (custom)
shd101wyy	crossnote	Affected: 0 , < 0.9.28 (custom)

Date Public

2026-06-05 00:00

Credits

Neo by ProjectDiscovery

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11422",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T13:09:37.324605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T13:09:58.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/2315"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced",
          "defaultStatus": "affected",
          "product": "Markdown Preview Enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "lessThan": "0.8.27",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://github.com/shd101wyy/crossnote",
          "defaultStatus": "affected",
          "product": "crossnote",
          "vendor": "shd101wyy",
          "versions": [
            {
              "lessThan": "0.9.28",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:shd101wyy:markdown_preview_enhanced:*:*:*:*:*:visual_studio_code:*:*",
                  "versionEndExcluding": "0.8.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Neo by ProjectDiscovery"
        }
      ],
      "datePublic": "2026-06-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMarkdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension\u0027s message passing and invoke arbitrary file writes on the local filesystem.\u003c/p\u003e"
            }
          ],
          "value": "Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension\u0027s message passing and invoke arbitrary file writes on the local filesystem."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T15:53:06.115Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/2315"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/shd101wyy/crossnote/commit/5588ca2121c3da43fe331575dc5cf4ef347b91ee"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/dcd80281c986293b93d9f1af34ced64dcb230c77"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/markdown-preview-enhanced-x-code-injection-via-wavedrom-rendering"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Markdown Preview Enhanced 0.8.x Code Injection via WaveDrom Rendering"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-11422",
    "datePublished": "2026-06-05T20:16:50.802Z",
    "dateReserved": "2026-06-05T20:01:11.442Z",
    "dateUpdated": "2026-07-14T15:53:06.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-50733 (GCVE-0-2026-50733)

Vulnerability from nvd – Published: 2026-06-05 17:49 – Updated: 2026-06-05 19:03

Title

Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()

Summary

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a <script type="WaveDrom"> element injected via raw HTML in markdown. When a victim previews or exports a crafted markdown document, an attacker can execute arbitrary code, leading to arbitrary file write. Fixed in 0.8.28 by parsing with JSON5.parse() and sanitizing WaveDrom data scripts to inert strict JSON.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-05 19:03 UTC

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6106 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	release-notes
https://github.com/shd101wyy/vscode-markdown-prev…	issue-tracking
https://www.vulncheck.com/advisories/markdown-pre…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
shd101wyy	Markdown Preview Enhanced	Affected: 0 , < 0.8.28 (semver) cpe:2.3:a:markdown_preview_enhanced_project:markdown_preview_enhanced::::::::

Date Public

2026-06-05 00:00

Credits

Neo by ProjectDiscovery

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50733",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-05T19:03:16.138729Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-05T19:03:27.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/2315"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Markdown Preview Enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "lessThan": "0.8.28",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:markdown_preview_enhanced_project:markdown_preview_enhanced:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.8.28",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neo by ProjectDiscovery"
        }
      ],
      "datePublic": "2026-06-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a \u003cscript type=\"WaveDrom\"\u003e element injected via raw HTML in markdown. When a victim previews or exports a crafted markdown document, an attacker can execute arbitrary code, leading to arbitrary file write. Fixed in 0.8.28 by parsing with JSON5.parse() and sanitizing WaveDrom data scripts to inert strict JSON."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T17:49:53.631Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Release 0.8.28",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28"
        },
        {
          "name": "Issue #2315",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/2315"
        },
        {
          "name": "VulnCheck Advisory: Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/markdown-preview-enhanced-arbitrary-code-execution-via-wavedrom-eval"
        }
      ],
      "title": "Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-50733",
    "datePublished": "2026-06-05T17:49:53.631Z",
    "dateReserved": "2026-06-05T16:54:32.159Z",
    "dateUpdated": "2026-06-05T19:03:27.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49493 (GCVE-0-2026-49493)

Vulnerability from nvd – Published: 2026-06-05 17:49 – Updated: 2026-06-09 14:36

Title

Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()

Summary

Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a malicious bitfield code block executes attacker-controlled code on the server side when the document is rendered or exported. Fixed in 0.8.28 by parsing bitfield register definitions with JSON5.parse(), since they are purely data.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 14:11 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6106 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	release-notes
https://www.vulncheck.com/advisories/markdown-pre…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
shd101wyy	Markdown Preview Enhanced	Affected: 0 , < 0.8.28 (semver) cpe:2.3:a:markdown_preview_enhanced_project:markdown_preview_enhanced::::::::

Date Public

2026-06-05 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49493",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T14:11:41.871600Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T14:36:57.617Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Markdown Preview Enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "lessThan": "0.8.28",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:markdown_preview_enhanced_project:markdown_preview_enhanced:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.8.28",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-06-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a malicious bitfield code block executes attacker-controlled code on the server side when the document is rendered or exported. Fixed in 0.8.28 by parsing bitfield register definitions with JSON5.parse(), since they are purely data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T17:49:52.826Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Release 0.8.28",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28"
        },
        {
          "name": "VulnCheck Advisory: Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/markdown-preview-enhanced-arbitrary-code-execution-via-bitfield-interpretjs"
        }
      ],
      "title": "Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-49493",
    "datePublished": "2026-06-05T17:49:52.826Z",
    "dateReserved": "2026-05-31T11:54:34.993Z",
    "dateUpdated": "2026-06-09T14:36:57.617Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49492 (GCVE-0-2026-49492)

Vulnerability from nvd – Published: 2026-06-05 17:49 – Updated: 2026-06-08 16:14

Title

Markdown Preview Enhanced OS Command Injection in External File and Link Opening

Summary

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixed in 0.8.28 by passing these inputs as literal arguments instead of through a shell and validating them before use.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 16:13 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6106 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	release-notes
https://www.vulncheck.com/advisories/markdown-pre…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
shd101wyy	Markdown Preview Enhanced	Affected: 0 , < 0.8.28 (semver) cpe:2.3:a:markdown_preview_enhanced_project:markdown_preview_enhanced::::::::

Date Public

2026-06-05 00:00

Credits

byte16384

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49492",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T16:13:18.480118Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T16:14:52.814Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows"
          ],
          "product": "Markdown Preview Enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "lessThan": "0.8.28",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:markdown_preview_enhanced_project:markdown_preview_enhanced:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.8.28",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "byte16384"
        }
      ],
      "datePublic": "2026-06-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixed in 0.8.28 by passing these inputs as literal arguments instead of through a shell and validating them before use."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T17:49:52.057Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Release 0.8.28",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28"
        },
        {
          "name": "VulnCheck Advisory: Markdown Preview Enhanced OS Command Injection in External File and Link Opening",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/markdown-preview-enhanced-os-command-injection-in-external-file-and-link-opening"
        }
      ],
      "title": "Markdown Preview Enhanced OS Command Injection in External File and Link Opening",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-49492",
    "datePublished": "2026-06-05T17:49:52.057Z",
    "dateReserved": "2026-05-31T11:54:34.993Z",
    "dateUpdated": "2026-06-08T16:14:52.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-65716 (GCVE-0-2025-65716)

Vulnerability from nvd – Published: 2026-02-16 00:00 – Updated: 2026-02-17 18:25

Summary

An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-17 18:25 UTC

CWE

n/a
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2327 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/shd101wyy/markdown-preview-enhanced
https://www.ox.security/blog/cve-2025-65716-markd…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-65716",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-17T18:25:10.224259Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-17T18:25:16.823Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-16T15:17:57.141Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/shd101wyy/markdown-preview-enhanced"
        },
        {
          "url": "https://www.ox.security/blog/cve-2025-65716-markdown-preview-enhanced-vscode-vulnerability/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-65716",
    "datePublished": "2026-02-16T00:00:00.000Z",
    "dateReserved": "2025-11-18T00:00:00.000Z",
    "dateUpdated": "2026-02-17T18:25:16.823Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54702 (GCVE-0-2026-54702)

Vulnerability from cvelistv5 – Published: 2026-10-14 19:13 – Updated: 2026-10-14 19:13

Title

Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler

Summary

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-749 - Exposed Dangerous Method or Function

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_CONFIRM
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shd101wyy	vscode-markdown-preview-enhanced	Affected: < 0.8.30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "vscode-markdown-preview-enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.30"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749: Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:13:58.946Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-83c6-hcjv-pvmg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-83c6-hcjv-pvmg"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30"
        }
      ],
      "source": {
        "advisory": "GHSA-83c6-hcjv-pvmg",
        "discovery": "UNKNOWN"
      },
      "title": "Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54702",
    "datePublished": "2026-10-14T19:13:58.946Z",
    "dateReserved": "2026-06-15T22:58:06.563Z",
    "dateUpdated": "2026-10-14T19:13:58.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54701 (GCVE-0-2026-54701)

Vulnerability from cvelistv5 – Published: 2026-10-14 19:11 – Updated: 2026-10-14 19:11

Title

Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview

Summary

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_CONFIRM
https://github.com/shd101wyy/crossnote/pull/444	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/crossnote/commit/8c5…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/crossnote/releases/t…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shd101wyy	vscode-markdown-preview-enhanced	Affected: < 0.8.30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "vscode-markdown-preview-enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.30"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:11:51.712Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-mcwg-4j78-qwv3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-mcwg-4j78-qwv3"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/pull/444",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/pull/444"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/commit/8c55a2ba3365712a1caa4abeece0383bc2994d48",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/commit/8c55a2ba3365712a1caa4abeece0383bc2994d48"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/releases/tag/0.9.31",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/releases/tag/0.9.31"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30"
        }
      ],
      "source": {
        "advisory": "GHSA-mcwg-4j78-qwv3",
        "discovery": "UNKNOWN"
      },
      "title": "Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54701",
    "datePublished": "2026-10-14T19:11:51.712Z",
    "dateReserved": "2026-06-15T22:58:06.563Z",
    "dateUpdated": "2026-10-14T19:11:51.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54703 (GCVE-0-2026-54703)

Vulnerability from cvelistv5 – Published: 2026-10-14 19:09 – Updated: 2026-10-14 19:09

Title

Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation

Summary

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS Code user's operating-system privileges, including user configuration, startup, source, and build files. This file-write vulnerability requires a separate webview JavaScript execution path, such as the independently tracked head.html injection and blind command-dispatch weaknesses. This issue is fixed in version 0.8.30.

Severity

5.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-73 - External Control of File Name or Path

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_CONFIRM
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shd101wyy	vscode-markdown-preview-enhanced	Affected: < 0.8.30

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "vscode-markdown-preview-enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.30"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS Code user\u0027s operating-system privileges, including user configuration, startup, source, and build files. This file-write vulnerability requires a separate webview JavaScript execution path, such as the independently tracked head.html injection and blind command-dispatch weaknesses. This issue is fixed in version 0.8.30."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:09:50.323Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-82rc-7g3m-2c42",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-82rc-7g3m-2c42"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30"
        }
      ],
      "source": {
        "advisory": "GHSA-82rc-7g3m-2c42",
        "discovery": "UNKNOWN"
      },
      "title": "Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54703",
    "datePublished": "2026-10-14T19:09:50.323Z",
    "dateReserved": "2026-06-15T22:58:06.563Z",
    "dateUpdated": "2026-10-14T19:09:50.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54566 (GCVE-0-2026-54566)

Vulnerability from cvelistv5 – Published: 2026-10-14 19:08 – Updated: 2026-10-14 19:45

Title

Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`

Summary

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 19:44 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_CONFIRM
https://github.com/shd101wyy/crossnote/pull/443	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/crossnote/commit/e48…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/crossnote/releases/t…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shd101wyy	vscode-markdown-preview-enhanced	Affected: < 0.8.29

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54566",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T19:44:50.050593Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T19:45:22.736Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jch"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vscode-markdown-preview-enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.29"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:08:43.663Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jch",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-427h-jhpr-8jch"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/pull/443",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/pull/443"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2320",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2320"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/commit/e4890d64502e53b717cce0cb73f1a78b244dc640",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/commit/e4890d64502e53b717cce0cb73f1a78b244dc640"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/0d4010988c6ae56a38c6dec4a7509cbd5a7dcb4c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/0d4010988c6ae56a38c6dec4a7509cbd5a7dcb4c"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/releases/tag/0.9.30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/releases/tag/0.9.30"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.29"
        }
      ],
      "source": {
        "advisory": "GHSA-427h-jhpr-8jch",
        "discovery": "UNKNOWN"
      },
      "title": "Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54566",
    "datePublished": "2026-10-14T19:08:43.663Z",
    "dateReserved": "2026-06-15T19:15:27.342Z",
    "dateUpdated": "2026-10-14T19:45:22.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54525 (GCVE-0-2026-54525)

Vulnerability from cvelistv5 – Published: 2026-10-14 19:06 – Updated: 2026-10-14 19:06

Title

Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows

Summary

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_CONFIRM
https://github.com/shd101wyy/crossnote/pull/442	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/crossnote/commit/558…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC
https://github.com/shd101wyy/crossnote/releases/t…	x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-prev…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shd101wyy	vscode-markdown-preview-enhanced	Affected: < 0.8.28

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "vscode-markdown-preview-enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.28"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T19:06:59.440Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-7v6f-3vq6-r373",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-7v6f-3vq6-r373"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/pull/442",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/pull/442"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2318",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2318"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/commit/5588ca2121c3da43fe331575dc5cf4ef347b91ee",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/commit/5588ca2121c3da43fe331575dc5cf4ef347b91ee"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/dcd80281c986293b93d9f1af34ced64dcb230c77",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/dcd80281c986293b93d9f1af34ced64dcb230c77"
        },
        {
          "name": "https://github.com/shd101wyy/crossnote/releases/tag/0.9.29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/crossnote/releases/tag/0.9.29"
        },
        {
          "name": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28"
        }
      ],
      "source": {
        "advisory": "GHSA-7v6f-3vq6-r373",
        "discovery": "UNKNOWN"
      },
      "title": "Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54525",
    "datePublished": "2026-10-14T19:06:59.440Z",
    "dateReserved": "2026-06-15T18:40:01.651Z",
    "dateUpdated": "2026-10-14T19:06:59.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11422 (GCVE-0-2026-11422)

Vulnerability from cvelistv5 – Published: 2026-06-05 20:16 – Updated: 2026-07-14 15:53

Title

Markdown Preview Enhanced 0.8.x Code Injection via WaveDrom Rendering

Summary

Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension's message passing and invoke arbitrary file writes on the local filesystem.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 13:09 UTC

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6106 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	issue-tracking
https://github.com/shd101wyy/crossnote/commit/558…	patch
https://github.com/shd101wyy/vscode-markdown-prev…	patch
https://www.vulncheck.com/advisories/markdown-pre…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
shd101wyy	Markdown Preview Enhanced	Affected: 0 , < 0.8.27 (custom)
shd101wyy	crossnote	Affected: 0 , < 0.9.28 (custom)

Date Public

2026-06-05 00:00

Credits

Neo by ProjectDiscovery

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11422",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T13:09:37.324605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T13:09:58.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/2315"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced",
          "defaultStatus": "affected",
          "product": "Markdown Preview Enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "lessThan": "0.8.27",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "collectionURL": "https://github.com/shd101wyy/crossnote",
          "defaultStatus": "affected",
          "product": "crossnote",
          "vendor": "shd101wyy",
          "versions": [
            {
              "lessThan": "0.9.28",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:shd101wyy:markdown_preview_enhanced:*:*:*:*:*:visual_studio_code:*:*",
                  "versionEndExcluding": "0.8.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Neo by ProjectDiscovery"
        }
      ],
      "datePublic": "2026-06-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMarkdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension\u0027s message passing and invoke arbitrary file writes on the local filesystem.\u003c/p\u003e"
            }
          ],
          "value": "Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview context to abuse the extension\u0027s message passing and invoke arbitrary file writes on the local filesystem."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T15:53:06.115Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/2315"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/shd101wyy/crossnote/commit/5588ca2121c3da43fe331575dc5cf4ef347b91ee"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/dcd80281c986293b93d9f1af34ced64dcb230c77"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/markdown-preview-enhanced-x-code-injection-via-wavedrom-rendering"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Markdown Preview Enhanced 0.8.x Code Injection via WaveDrom Rendering"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-11422",
    "datePublished": "2026-06-05T20:16:50.802Z",
    "dateReserved": "2026-06-05T20:01:11.442Z",
    "dateUpdated": "2026-07-14T15:53:06.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-50733 (GCVE-0-2026-50733)

Vulnerability from cvelistv5 – Published: 2026-06-05 17:49 – Updated: 2026-06-05 19:03

Title

Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()

Summary

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a <script type="WaveDrom"> element injected via raw HTML in markdown. When a victim previews or exports a crafted markdown document, an attacker can execute arbitrary code, leading to arbitrary file write. Fixed in 0.8.28 by parsing with JSON5.parse() and sanitizing WaveDrom data scripts to inert strict JSON.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-05 19:03 UTC

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6106 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	release-notes
https://github.com/shd101wyy/vscode-markdown-prev…	issue-tracking
https://www.vulncheck.com/advisories/markdown-pre…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
shd101wyy	Markdown Preview Enhanced	Affected: 0 , < 0.8.28 (semver) cpe:2.3:a:markdown_preview_enhanced_project:markdown_preview_enhanced::::::::

Date Public

2026-06-05 00:00

Credits

Neo by ProjectDiscovery

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50733",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-05T19:03:16.138729Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-05T19:03:27.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/2315"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Markdown Preview Enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "lessThan": "0.8.28",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:markdown_preview_enhanced_project:markdown_preview_enhanced:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.8.28",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Neo by ProjectDiscovery"
        }
      ],
      "datePublic": "2026-06-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a \u003cscript type=\"WaveDrom\"\u003e element injected via raw HTML in markdown. When a victim previews or exports a crafted markdown document, an attacker can execute arbitrary code, leading to arbitrary file write. Fixed in 0.8.28 by parsing with JSON5.parse() and sanitizing WaveDrom data scripts to inert strict JSON."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T17:49:53.631Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Release 0.8.28",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28"
        },
        {
          "name": "Issue #2315",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/2315"
        },
        {
          "name": "VulnCheck Advisory: Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/markdown-preview-enhanced-arbitrary-code-execution-via-wavedrom-eval"
        }
      ],
      "title": "Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-50733",
    "datePublished": "2026-06-05T17:49:53.631Z",
    "dateReserved": "2026-06-05T16:54:32.159Z",
    "dateUpdated": "2026-06-05T19:03:27.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49493 (GCVE-0-2026-49493)

Vulnerability from cvelistv5 – Published: 2026-06-05 17:49 – Updated: 2026-06-09 14:36

Title

Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()

Summary

Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a malicious bitfield code block executes attacker-controlled code on the server side when the document is rendered or exported. Fixed in 0.8.28 by parsing bitfield register definitions with JSON5.parse(), since they are purely data.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 14:11 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6106 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	release-notes
https://www.vulncheck.com/advisories/markdown-pre…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
shd101wyy	Markdown Preview Enhanced	Affected: 0 , < 0.8.28 (semver) cpe:2.3:a:markdown_preview_enhanced_project:markdown_preview_enhanced::::::::

Date Public

2026-06-05 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49493",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T14:11:41.871600Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T14:36:57.617Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Markdown Preview Enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "lessThan": "0.8.28",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:markdown_preview_enhanced_project:markdown_preview_enhanced:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.8.28",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-06-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a malicious bitfield code block executes attacker-controlled code on the server side when the document is rendered or exported. Fixed in 0.8.28 by parsing bitfield register definitions with JSON5.parse(), since they are purely data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T17:49:52.826Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Release 0.8.28",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28"
        },
        {
          "name": "VulnCheck Advisory: Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/markdown-preview-enhanced-arbitrary-code-execution-via-bitfield-interpretjs"
        }
      ],
      "title": "Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-49493",
    "datePublished": "2026-06-05T17:49:52.826Z",
    "dateReserved": "2026-05-31T11:54:34.993Z",
    "dateUpdated": "2026-06-09T14:36:57.617Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49492 (GCVE-0-2026-49492)

Vulnerability from cvelistv5 – Published: 2026-06-05 17:49 – Updated: 2026-06-08 16:14

Title

Markdown Preview Enhanced OS Command Injection in External File and Link Opening

Summary

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixed in 0.8.28 by passing these inputs as literal arguments instead of through a shell and validating them before use.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-08 16:13 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6106 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/shd101wyy/vscode-markdown-prev…	release-notes
https://www.vulncheck.com/advisories/markdown-pre…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
shd101wyy	Markdown Preview Enhanced	Affected: 0 , < 0.8.28 (semver) cpe:2.3:a:markdown_preview_enhanced_project:markdown_preview_enhanced::::::::

Date Public

2026-06-05 00:00

Credits

byte16384

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49492",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T16:13:18.480118Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T16:14:52.814Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows"
          ],
          "product": "Markdown Preview Enhanced",
          "vendor": "shd101wyy",
          "versions": [
            {
              "lessThan": "0.8.28",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:markdown_preview_enhanced_project:markdown_preview_enhanced:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.8.28",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "byte16384"
        }
      ],
      "datePublic": "2026-06-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixed in 0.8.28 by passing these inputs as literal arguments instead of through a shell and validating them before use."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T17:49:52.057Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Release 0.8.28",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.28"
        },
        {
          "name": "VulnCheck Advisory: Markdown Preview Enhanced OS Command Injection in External File and Link Opening",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/markdown-preview-enhanced-os-command-injection-in-external-file-and-link-opening"
        }
      ],
      "title": "Markdown Preview Enhanced OS Command Injection in External File and Link Opening",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-49492",
    "datePublished": "2026-06-05T17:49:52.057Z",
    "dateReserved": "2026-05-31T11:54:34.993Z",
    "dateUpdated": "2026-06-08T16:14:52.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-65716 (GCVE-0-2025-65716)

Vulnerability from cvelistv5 – Published: 2026-02-16 00:00 – Updated: 2026-02-17 18:25

Summary

An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-17 18:25 UTC

CWE

n/a
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2327 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/shd101wyy/markdown-preview-enhanced
https://www.ox.security/blog/cve-2025-65716-markd…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-65716",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-17T18:25:10.224259Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-17T18:25:16.823Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-16T15:17:57.141Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/shd101wyy/markdown-preview-enhanced"
        },
        {
          "url": "https://www.ox.security/blog/cve-2025-65716-markdown-preview-enhanced-vscode-vulnerability/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-65716",
    "datePublished": "2026-02-16T00:00:00.000Z",
    "dateReserved": "2025-11-18T00:00:00.000Z",
    "dateUpdated": "2026-02-17T18:25:16.823Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

20 vulnerabilities by shd101wyy

CVE-2026-54703 (GCVE-0-2026-54703)

CVE-2026-54702 (GCVE-0-2026-54702)

CVE-2026-54701 (GCVE-0-2026-54701)

CVE-2026-54566 (GCVE-0-2026-54566)

CVE-2026-54525 (GCVE-0-2026-54525)

CVE-2026-11422 (GCVE-0-2026-11422)

CVE-2026-50733 (GCVE-0-2026-50733)

CVE-2026-49493 (GCVE-0-2026-49493)

CVE-2026-49492 (GCVE-0-2026-49492)

CVE-2025-65716 (GCVE-0-2025-65716)

CVE-2026-54702 (GCVE-0-2026-54702)

CVE-2026-54701 (GCVE-0-2026-54701)

CVE-2026-54703 (GCVE-0-2026-54703)

CVE-2026-54566 (GCVE-0-2026-54566)

CVE-2026-54525 (GCVE-0-2026-54525)

CVE-2026-11422 (GCVE-0-2026-11422)

CVE-2026-50733 (GCVE-0-2026-50733)

CVE-2026-49493 (GCVE-0-2026-49493)

CVE-2026-49492 (GCVE-0-2026-49492)

CVE-2025-65716 (GCVE-0-2025-65716)