---
id: CVE-2026-54703
title: >-
  Markdown Preview Enhanced is a Markdown preview extension for Visual Studio
  Code
summary: >-
  Markdown Preview Enhanced is a Markdown preview extension for Visual Studio
  Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown
  Preview Enhanced accepts an arbitrary URI and attacker-controlled content,
  then passes t…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-73
vendor: shd101wyy
product: vscode-markdown-preview-enhanced
affected:
  - vscode-markdown-preview-enhanced < 0.8.30
published: '2026-10-14'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:02:37.630'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54703'
references:
  - url: >-
      https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e
    label: security-advisories@github.com
  - url: 'https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323'
    label: security-advisories@github.com
  - url: >-
      https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30
    label: security-advisories@github.com
  - url: >-
      https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-82rc-7g3m-2c42
    label: security-advisories@github.com
  - url: >-
      https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-82rc-7g3m-2c42
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00304
epssPercentile: 0.23046
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T14:18:41.174544Z'
cvssSource: cna
ingestedAt: '2026-10-14T20:53:12.377Z'
---

## Overview

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS Code user's operating-system privileges, including user configuration, startup, source, and build files. This file-write vulnerability requires a separate webview JavaScript execution path, such as the independently tracked head.html injection and blind command-dispatch weaknesses. This issue is fixed in version 0.8.30.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.