CVE-2026-54702

Awaiting Analysis Awaiting Analysis - Queue

Command Injection in Markdown Preview Enhanced Extension

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-54702

EUVD

EUVD-2026-101585

Affected Vendors & Products

Vendor	Product	Version / Range
shd101wyy	vscode-markdown-preview-enhanced	< 0.8.30

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-749	The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Attack-Flow Graph

Executive Summary

This vulnerability affects the VSCode Markdown Preview Enhanced extension. It allows malicious JavaScript in the webview to execute privileged commands without validation. The extension's message handler blindly forwards commands to VS Code, bypassing security checks. Exploitation requires injecting JavaScript via an unsanitized head.html file.

Detection Guidance

Check the installed version of the VSCode Markdown Preview Enhanced extension. If it is version 0.8.28 or earlier, the system is vulnerable. Look for suspicious JavaScript execution in the extension's webview or unexpected file modifications and command invocations.

Impact Analysis

An attacker could execute arbitrary commands like file modification, code execution, or opening malicious URLs. This could lead to data theft, system compromise, or further attacks. Users of vulnerable versions (0.8.28 or earlier) are at risk if they view malicious markdown files.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy). Organizations using the extension may face compliance breaches if exploited, resulting in legal or financial penalties.

Mitigation Strategies

Update the VSCode Markdown Preview Enhanced extension to version 0.8.30 or later. If updating is not possible, disable the extension immediately to prevent exploitation. Review any recent file changes or command executions for signs of compromise.

Hi! I’m here to help you understand CVE-2026-54702. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70