CVE-2026-54525

8.8High

Published 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Attackers can execute arbitrary commands with the privileges of the local VS Code user on Windows. Exploitation requires convincing a user to open an untrusted Markdown file and click a crafted link in the preview window.

Root cause

The extension passes decoded, untrusted link targets directly to child_process.exec via the Windows 'start' command, letting shell metacharacters act as cmd.exe command separators.

Affected systems

Markdown Preview Enhanced for VS Code versions prior to 0.8.28 (on Windows).

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade the Markdown Preview Enhanced VS Code extension to version 0.8.28 or later. If patching immediately is not possible, disable or uninstall the extension.

shell

$ code --install-extension shd101wyy.markdown-preview-enhanced --force

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-54525