Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54525— Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows

Quick assessment

Affected
shd101wyy vscode-markdown-preview-enhanced
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Markdown Preview Enhanced 是 Visual Studio Code 的一个 Markdown 预览扩展。在版本 0.8.28 之前，该扩展在处理预览链接时，会将经过解码的、由 Markdown 控制的链接目标传递给一个用于 Windows 文件打开的辅助程序，该辅助程序会通过 调用 命令。当 Windows 用户打开一个不受信任的 Markdown 文件并点击一个精心构造的外部链接或不受支持的协议方案的链接时，解码后目标中的 shell 元字符会被 解释为命令分隔符，从而允许攻击者选择的命

CVSS 8.8 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
shd101wyy vscode-markdown-preview-enhanced < 0.8.28 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54525

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows
Source: CVE Program / CVE List V5
Vulnerability Description
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
shd101wyy vscode-markdown-preview-enhanced < 0.8.28 -

II. Public POCs for CVE-2026-54525

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54525

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54525 (3)

Vendor Pages for CVE-2026-54525 (1)

Other References for CVE-2026-54525 (2)

Same Patch Batch · shd101wyy · 2026-10-14 · 5 CVEs total

CVE-2026-54566 8.5 HIGH Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/conf
CVE-2026-54702 7.3 HIGH Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler
CVE-2026-54701 6.9 MEDIUM Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in
CVE-2026-54703 5.8 MEDIUM Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Va

IV. Related Vulnerabilities

Same product: vscode-markdown-preview-enhanced
Same vendor: shd101wyy
Same weakness: CWE-78

V. Comments for CVE-2026-54525

No comments yet

Leave a comment