CVE-2026-54702: Markdown Preview Enhanced command injection in webview message handler

CVE-2026-54702 · Severity: info · Published 2026-10-14

Markdown Preview Enhanced is a preview extension for Visual Studio Code that renders markdown documents in a browser-like preview pane. Prior to version 0.8.30, the extension blindly executes any command sent from the preview webview without validation, allowing malicious markdown files to run dangerous operations like modifying arbitrary files, executing code, or opening unexpected URLs. An attacker would need to trick a user into previewing a crafted markdown file that exploits a separate webview injection vulnerability.

Technologies: Shd101wyy Markdown Preview Enhanced. Vendors: Shd101wyy.

Quick answers

Is CVE-2026-54702 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54702 being exploited in the wild.
How severe is CVE-2026-54702?
Informational severity, published 14 October 2026.
Which products and versions are affected?
Shd101wyy Markdown Preview Enhanced before 0.8.30.
Is there a fix for CVE-2026-54702?
Yes: fixed in 0.8.30. Until then: Upgrade to version 0.8.30 or later, which adds a strict allowlist of legitimate webview commands, validates that args is always an array, and enforces markdown file extension validation in updateMarkdown to prevent arbitrary file writes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54702 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54702?
Check whether you run Shd101wyy Markdown Preview Enhanced at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 0.8.30

Upgrade to version 0.8.30 or later, which adds a strict allowlist of legitimate webview commands, validates that args is always an array, and enforces markdown file extension validation in updateMarkdown to prevent arbitrary file writes.

Technical details

The webview message handler in src/preview-provider.ts accepts attacker-controlled command and args values, constructs _crossnote.{command} invocations, and dispatches them via vscode.commands.executeCommand without an allowlist or argument type validation. This allows JavaScript executing in a compromised preview webview to invoke privileged extension commands (updateMarkdown, chromeExport, pandocExport, etc.) with arbitrary parameters. The vulnerability requires a separate webview XSS vector to execute malicious JavaScript, but once code runs in the webview, it can invoke any extension command without further authorization checks.

Affected products

  • shd101wyy Markdown Preview Enhanced before 0.8.30

Timeline

  • 2026-06-08: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.