CVE-2026-54701

Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Markdown Preview Enhanced for VS Code

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-54701

EUVD

EUVD-2026-101584

Affected Vendors & Products

Vendor	Product	Version / Range
shd101wyy	vscode-markdown-preview-enhanced	< 0.8.30

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in the Markdown Preview Enhanced VS Code extension. Malicious repositories can inject unsanitized <script> tags into the .crossnote/head.html file. When a user opens a Markdown file with this extension, the script executes immediately in the preview webview before security measures like DOMPurify or CSP activate. The script can access the VS Code API to send arbitrary messages to the extension host, potentially leading to code execution or data theft.

Detection Guidance

Check the installed version of vscode-markdown-preview-enhanced in VS Code by running the Extensions view (Ctrl+Shift+X), searching for the extension, and verifying the version number. If it is below 0.8.30, the system is vulnerable. Additionally, inspect any repository containing a .crossnote/head.html file for embedded <script> tags, which could indicate malicious content.

Impact Analysis

If you open a Markdown file from an untrusted source in VS Code with the vulnerable extension, malicious scripts could execute automatically. This may allow attackers to steal sensitive data via the VS Code API, execute arbitrary commands on your system, or perform actions in your VS Code environment without your knowledge. The attack requires no additional user interaction beyond opening the file.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. If exploited, it may result in data breaches, unauthorized disclosure of personal or medical data, and failure to maintain confidentiality and integrity of sensitive information.

Mitigation Strategies

Update the vscode-markdown-preview-enhanced extension to version 0.8.30 or later via VS Code's Extensions view. Remove any .crossnote/head.html files from repositories you open in VS Code. Avoid opening Markdown files from untrusted sources until the extension is updated.

Hi! I’m here to help you understand CVE-2026-54701. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70