CVE-2026-54701

Severity not reported

Data quality: awaiting analysis. NVD has not completed analysis, so CVSS and affected-product data may be missing or change.

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30.

CVSS

—

Awaiting analysis by NVD

Timeline (UTC)

Published: 2026-10-14 20:17

Modified: 2026-10-20 03:17

NVD status: Awaiting Analysis

Last synced 1 day ago

Verified against the source API 2026-10-27 07:02 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-79

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://github.com/shd101wyy/crossnote/commit/8c55a2ba3365712a1caa4abeece0383bc2994d48 security-advisories@github.com
https://github.com/shd101wyy/crossnote/pull/444 security-advisories@github.com
https://github.com/shd101wyy/crossnote/releases/tag/0.9.31 security-advisories@github.com
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f... security-advisories@github.com
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323 security-advisories@github.com
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30 security-advisories@github.com
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-mcw... security-advisories@github.com
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-mcw... 134c704f-9b21-4f2e-91b3-4a467353bcc0

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:02 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores