2098 matches found
EUVD-2026-101582
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js hos...
CVE-2026-54566
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js hos...
CVE-2026-54566 Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js hos...
CVE-2026-54525
The Markdown Preview Enhanced extension for Visual Studio Code is vulnerable to OS Command Injection prior to version 0.8.28 . The root cause is the improper neutralization of special elements in the preview-link handling logic, where a decoded, Markdown-controlled link target is passed to a Wind...
CVE-2026-54525 Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes childprocess.exec with the start command. When a Windo...
PT-2026-114204
Name of the Vulnerable Software and Affected Versions Markdown Preview Enhanced versions prior to 0.8.30 Description This extension for Visual Studio Code reads content from the .crossnote/head.html file within a repository and processes it through the resolvePathsInHeader function before inserti...
CVE-2026-54703: External Control of File Name or Path
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that...
CVE-2026-54566: Improper Control of Generation of Code
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js hos...
CVE-2026-54525: Improper Neutralization of Special Elements used in an OS Command
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes childprocess.exec with the start command. When a Windo...
PT-2026-114203
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js hos...
CVE-2026-54701: Improper Neutralization of Input During Web Page Generation
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document withou...
CVE-2026-70098
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-102235
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-102238
Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-102234
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-69370
Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-102851
Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally...
CVE-2026-102229
Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an authorized attacker to disclose information over a network...