CVE-2026-54566

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js hos...

CVE-2026-54701

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document withou...

CVE-2026-54525

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes childprocess.exec with the start command. When a Windo...

EUVD-2026-101585

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

CVE-2026-54702 Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

CVE-2026-54702 Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

CVE-2026-54701

The Markdown Preview Enhanced extension for Visual Studio Code is vulnerable to Stored XSS in versions prior to 0.8.30 . The extension improperly handles repository-controlled content from .crossnote/head.html by passing it through resolvePathsInHeader and inserting it into the webview head witho...

EUVD-2026-101584

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document withou...

CVE-2026-54701

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document withou...

CVE-2026-54701 Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document withou...

CVE-2026-54701 Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document withou...

CVE-2026-54701 Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document withou...

CVE-2026-54703 Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that...

CVE-2026-54703

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that...

CVE-2026-54703 Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that...

CVE-2026-54703

The Markdown Preview Enhanced extension for Visual Studio Code is vulnerable to an arbitrary file write in versions prior to 0.8.30 . The root cause is that the _crossnote.updateMarkdown command accepts an arbitrary URI and attacker-controlled content, passing them to vscode.workspace.fs.writeFil...

CVE-2026-54703 Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that...

EUVD-2026-101583

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that...

EUVD-2026-101582

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js hos...

CVE-2026-54566 Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js hos...