CVE-2026-54525

Awaiting Analysis Awaiting Analysis - Queue

Command Injection in Markdown Preview Enhanced

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-54525

EUVD

EUVD-2026-101581

Affected Vendors & Products

Vendor	Product	Version / Range
shd101wyy	vscode-markdown-preview-enhanced	< 0.8.28

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-54525 is a command injection flaw in the vscode-markdown-preview-enhanced extension for Visual Studio Code. When a user opens a crafted markdown file and clicks a specially designed link in the preview, the extension improperly handles the link's href attribute. It passes the decoded link target to a Windows file-opening helper that uses child_process.exec, allowing shell metacharacters in the link to execute arbitrary commands with the privileges of the current VS Code user.

Detection Guidance

To detect this vulnerability, check if you are using vscode-markdown-preview-enhanced version 0.8.27 or earlier. Run the VS Code extension manager command: code --list-extensions | grep markdown-preview-enhanced. If installed, verify the version in the Extensions view or via the command: code --show-versions.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary commands on your system with the same privileges as your VS Code user. An attacker could craft a malicious markdown file with a link containing shell metacharacters. When you open the file and click the link, the attacker's command runs silently in the background, potentially stealing data, installing malware, or taking control of your system.

Compliance Impact

This vulnerability primarily enables arbitrary code execution on Windows systems when a user clicks a crafted link in a Markdown file. While it does not directly violate GDPR or HIPAA, it could lead to unauthorized access to personal or health data if exploited. Compliance risks arise if the vulnerability allows attackers to exfiltrate sensitive data (e.g., PHI under HIPAA or PII under GDPR) or disrupt systems handling regulated data. The lack of required privileges or additional files lowers the barrier for exploitation, increasing potential compliance violations.

Mitigation Strategies

Update vscode-markdown-preview-enhanced to version 0.8.28 or later immediately. Disable the extension if an update is not available. Avoid opening untrusted Markdown files in VS Code until patched. Monitor for suspicious processes after clicking links in previews.

Hi! I’m here to help you understand CVE-2026-54525. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70