CVE-2026-54702

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

CVE-2026-54702

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

CVE-2026-54702 Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

CVE-2026-54702: Exposed Dangerous Method or Function

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

Yiyi Wang Markdown Preview Enhanced Permission Licensing and Access Control Vulnerabilities

Yiyi Wang’s Markdown Preview Enhanced version prior to 0.8.30 contained vulnerabilities related to permission management and access control. These vulnerabilities stemmed from the webview message handler in src/preview-provider.ts, which failed to validate command values and parameters against a...