CVE-2026-54703

Awaiting Analysis Awaiting Analysis - Queue

File Write Vulnerability in Markdown Preview Enhanced Extension

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS Code user's operating-system privileges, including user configuration, startup, source, and build files. This file-write vulnerability requires a separate webview JavaScript execution path, such as the independently tracked head.html injection and blind command-dispatch weaknesses. This issue is fixed in version 0.8.30.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-54703

EUVD

EUVD-2026-101583

Affected Vendors & Products

Vendor	Product	Version / Range
shd101wyy	vscode-markdown-preview-enhanced	< 0.8.30

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability is an arbitrary file write issue in the Markdown Preview Enhanced extension for VS Code. The updateMarkdown command accepts attacker-controlled URIs and content without validating the target path. JavaScript in the preview webview can exploit this to write files anywhere the VS Code user has permissions, including sensitive system or project files.

Detection Guidance

Check if you have the vulnerable extension version (up to 0.8.28) installed in VS Code. Look for suspicious file writes in system directories like ~/.bashrc, ~/.zshrc, or project files. Monitor for unexpected changes in configuration files or unauthorized modifications to sensitive files.

Impact Analysis

An attacker could overwrite critical files like shell configurations (~/.bashrc), SSH keys, or project files. This may lead to remote code execution, persistent SSH access, or settings manipulation. Exploitation requires a malicious file in a repository opened with the vulnerable extension.

Compliance Impact

This vulnerability could lead to unauthorized file writes, potentially exposing or modifying sensitive data such as configuration files, user profiles, or project files. For GDPR, this may result in unauthorized access or processing of personal data, violating principles of data protection and user consent. For HIPAA, it could allow unauthorized changes to protected health information or system configurations, compromising confidentiality and integrity of sensitive health data.

Mitigation Strategies

Update the Markdown Preview Enhanced extension to version 0.8.30 or later. Remove any untrusted markdown files or repositories from your system. Revoke any suspicious changes made to sensitive files like ~/.bashrc or ~/.ssh/authorized_keys.

Hi! I’m here to help you understand CVE-2026-54703. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70