CVE-2026-54703Medium· 5.8▾ TwilightPoC availableMarkdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes t…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 31.9 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 5.8
none → medium
Exploit / PoC code exists
Last analysed / modified upstream
0.2%
0.2% → 0.3%
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS Code user's operating-system privileges, including user configuration, startup, source, and build files. This file-write vulnerability requires a separate webview JavaScript execution path, such as the independently tracked head.html injection and blind command-dispatch weaknesses. This issue is fixed in version 0.8.30.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54702High· 7.3Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code
CVE-2026-54701Medium· 6.9Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code
CVE-2026-54566High· 8.5Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code
CVE-2026-54525High· 8.8Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code
CVE-2026-26157High· 7.0A flaw was found in BusyBox
CVE-2026-114253Medium· 6.3oretnom23 file-management-system-php index.php include file inclusion