# CVE-2026-54525: Markdown Preview Enhanced command injection in preview links on Windows

Source: https://junglewise.ai/threats/cve-2026-54525-markdown-preview-enhanced-is-a-markdown-preview-extension-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-54525 · Severity: high · CVSS 8.8 · Published 2026-10-14

Markdown Preview Enhanced is a Visual Studio Code extension that renders Markdown files with rich previews. On Windows systems, clicking a crafted link in an untrusted Markdown file allows an attacker to execute arbitrary commands with the privileges of the current VS Code user. The attack requires only a single click and no additional setup or configuration.

Technologies: [Shd101wyy Markdown Preview Enhanced](https://junglewise.ai/threats/technologies/markdown-preview-enhanced). Vendors: [Shd101wyy](https://junglewise.ai/threats/vendors/shd101wyy).

## Quick answers

**Is CVE-2026-54525 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54525 being exploited in the wild.

**How severe is CVE-2026-54525?** High severity, with a CVSS score of 8.8, published 14 October 2026.

**Which products and versions are affected?** Shd101wyy Markdown Preview Enhanced prior to 0.8.28.

**Is there a fix for CVE-2026-54525?** Yes: fixed in 0.8.28. Until then: Avoid opening untrusted or unfamiliar Markdown files in Visual Studio Code until the extension is updated. Users on non-Windows systems are not affected by this particular vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54525 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54525?** Check whether you run Shd101wyy Markdown Preview Enhanced at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.8.28

Avoid opening untrusted or unfamiliar Markdown files in Visual Studio Code until the extension is updated. Users on non-Windows systems are not affected by this particular vulnerability.

## Technical details

The vulnerability exists in the preview-link handling code, which uses child_process.exec() with the Windows start command to open external links. The link target is URL-decoded but not sanitized before being passed to the shell, allowing shell metacharacters (such as &) to be interpreted as command separators by cmd.exe. An attacker can craft a Markdown link like [x](mailto:a%26%20calc.exe) that decodes to mailto:a& calc.exe, causing cmd.exe to execute calc.exe as a second command. The fix replaces shell execution with execFile('explorer.exe', [target]) which treats the target as a single unsanitized argument.

## Affected products

- shd101wyy Markdown Preview Enhanced prior to 0.8.28

## Timeline

- 2026-10-14: disclosed

## References

- [https://github.com/shd101wyy/crossnote/commit/5588ca2121c3da43fe331575dc5cf4ef347b91ee](https://github.com/shd101wyy/crossnote/commit/5588ca2121c3da43fe331575dc5cf4ef347b91ee)
- [https://github.com/shd101wyy/crossnote/pull/442](https://github.com/shd101wyy/crossnote/pull/442)

## Related threats

- [Markdown Preview Enhanced command injection in webview message handler](https://junglewise.ai/threats/cve-2026-54702-markdown-preview-enhanced-is-a-markdown-preview-extension-for)
- [Markdown Preview Enhanced code execution via untrusted config.js](https://junglewise.ai/threats/cve-2026-54566-markdown-preview-enhanced-is-a-markdown-preview-extension-for)
- [Markdown Preview Enhanced code injection in WaveDrom rendering](https://junglewise.ai/threats/cve-2026-11422-markdown-preview-enhanced-code-injection-in-wavedrom-rendering)
- [Markdown Preview Enhanced code injection in WaveDrom rendering](https://junglewise.ai/threats/cve-2026-50733-markdown-preview-enhanced-code-injection-in-wavedrom-rendering)
- [Markdown Preview Enhanced code execution in Bitfield renderer](https://junglewise.ai/threats/cve-2026-49493-markdown-preview-enhanced-code-execution-in-bitfield-renderer)