Vulnerabilities

TI-2026-74455 CVE-2026-54702

Unvalidated command dispatch in Markdown Preview Enhanced extension

HIGH 67

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.

CVSS 4.0HIGH 7.3 Local No auth User interaction EPSS 0.00312 Published 2026-10-14 Fixed in 0.8.30 CWE-749

TI-2026-74454 CVE-2026-54701

Cross-site scripting in Markdown Preview Enhanced VS Code extension

MEDIUM 64

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.

CVSS 4.0MEDIUM 6.9 Local No auth User interaction EPSS 0.00297 Published 2026-10-14 Fixed in 0.8.30 CWE-79

TI-2026-74456 CVE-2026-54703

Arbitrary file write in Markdown Preview Enhanced for VS Code

MEDIUM 59

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.

CVSS 4.0MEDIUM 5.8 Local No auth User interaction EPSS 0.00304 Published 2026-10-14 Fixed in 0.8.30 CWE-73

TI-2026-74453 CVE-2026-54566

Sandbox escape in Markdown Preview Enhanced allows code execution

HIGH 72

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00296 Published 2026-10-14 Fixed in 0.8.29 CWE-94

TI-2026-74436 CVE-2026-54525

OS command injection in Markdown Preview Enhanced on Windows

MEDIUM 40

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00429 Published 2026-10-14 Fixed in 0.8.28 CWE-78

TI-2026-09857 CVE-2026-11422 · GHSA-m48c-hxqg-4j76

Markdown Preview Enhanced 0.8.x Code Injection via WaveDrom Rendering

HIGH 72

Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content…

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00159 Published 2026-06-05 Fixed in 0.8.27, 0.9.28 CWE-95

TI-2026-37396 CVE-2026-50733 · GHSA-j39p-jf99-v5w8

Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()

HIGH 72

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00667 Published 2026-06-05 Fixed in 0.8.28 CWE-95

TI-2026-36643 CVE-2026-49493 · GHSA-m5v2-jw65-jh59

Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()

LOW 39

Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00327 Published 2026-06-05 Fixed in 0.8.28 CWE-94

TI-2026-36642 CVE-2026-49492 · GHSA-3vxg-8vgp-994w

Markdown Preview Enhanced OS Command Injection in External File and Link Opening

LOW 39

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported f…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.0034 Published 2026-06-05 Fixed in 0.8.28 CWE-78

TI-2025-40425 CVE-2025-65716 · GHSA-5cph-5v9q-vh7g

An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows…

HIGH 73

An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00825 Published 2026-02-16 No fix listed CWE-94

Vulnerabilities

Filters