CVE-2022-45025

CVE-2022-45025 Command injection via PDF import in Markdown Preview Enhanced VSCode, Atom Description The Mume markdown tool library was vulnerable to command injection due to use of spawn command with shell: true option. This could allow an attacker to achieve arbitary code execution by tricking...

CVE-2026-129170 FileCodeBox 2.2.1 through 2.8.4 Stored XSS via Markdown Preview Parser Error

FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which returns unsanitized text when the marked parser throws. Unauthenticated attackers can share text with thousands of nested blockquote markers followed by HTML payloads, executing...

CVE-2026-129170

FileCodeBox versions 2.2.1 through 2.8.4 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the renderMarkdownPreview function. The root cause is an improper handling of errors where the markdown parser throws an exception, causing the application to return unsanitized tex...

JetBrains IntelliJ IDEA < 2026.2.4 Multiple Vulnerabilities

The version of JetBrains IntelliJ IDEA installed on the remote host is prior to 2026.2.4. It is, therefore, affected by multiple vulnerabilities: - In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting...

CVE-2026-64670 Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit

Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer utils/markdown.ts, and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw,...

CVE-2026-64670 Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit

Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer utils/markdown.ts, and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw,...

CVE-2026-64670

The @waline/client comment system (versions 3.15.2 and prior ) is vulnerable to Stored XSS due to an unsanitized markdown preview in the comment editor. The application renders the comment body using marked without a sanitizer in utils/markdown.ts and injects the result via v-html. When a comment...

CVE-2026-123311

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible...

CVE-2026-123309

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview...

CVE-2026-123311

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible...

CVE-2026-123311

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible...

EUVD-2026-118075

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible...

CVE-2026-123311

JetBrains IntelliJ IDEA versions before 2026.3 and 2026.2.4 are vulnerable to command execution due to a hidden run control within the Markdown preview feature. This flaw is classified as an improper restriction of rendered UI layers or frames (CWE-1021). The vulnerability requires local access a...

CVE-2026-123309

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview...

CVE-2026-123309

JetBrains IntelliJ IDEA versions before 2026.3 (specifically 2026.2.4) are vulnerable to stored XSS on the built-in web server. The vulnerability is triggered via the Markdown preview feature. This flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and h...

EUVD-2026-118073

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview...

PT-2026-137955

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.3 Description A stored Cross-Site Scripting XSS issue exists on the built-in web server through the Markdown preview feature. XSS is a technique where malicious scripts are injected into trusted...

CVE-2026-123311: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview…

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible...

CVE-2026-123309: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown…

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview...

CVE-2026-54702

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...