CVE-2026-54702

7.3High

Published 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.3High

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Passive
Impact: Full C/I/A compromise
Weakness: CWE-749

Impact

Attackers can execute arbitrary code chunks, modify files, and run local export tools in the context of the user's VS Code session. They first need a way to execute JavaScript within the extension's preview webview, such as via an injected file.

Root cause

The preview webview message handler executes arbitrary commands under the _crossnote namespace via vscode.commands.executeCommand without validating command names or argument types against an allowlist.

Affected systems

Markdown Preview Enhanced VS Code extension versions prior to 0.8.30

CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade the Markdown Preview Enhanced extension to version 0.8.30 or later. If updating immediately is not possible, disable the extension until it can be patched.

shell

$ code --install-extension shd101wyy.markdown-preview-enhanced --force

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-54702