Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54701— Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview

Quick assessment

Affected
shd101wyy vscode-markdown-preview-enhanced
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Markdown Preview Enhanced 是 Visual Studio Code 的一款 Markdown 预览扩展。在版本 0.8.30 之前，该扩展会读取由仓库控制的 文件内容，并在调用 处理后，将其插入到预览 Webview 文档的 部分，且未清除其中的可执行代码。 由于此类包含脚本标记的内容在文档加载阶段即会执行，而此时 React 应用和 DOMPurify 安全过滤器尚未初始化，因此注入的脚本可以访问 接口，从而允许从 Webview 向扩展主机发送消息。 攻击者只需打开一个包含恶意内容的仓

CVSS 6.9 · Medium EPSS 0.21% · P10

Possible ATT&CK Techniques 1 AI

T1505.003 · Web Shell

Affected Version Matrix 1

VendorProduct Version RangeStatus
shd101wyy vscode-markdown-preview-enhanced < 0.8.30 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54701

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview
Source: CVE Program / CVE List V5
Vulnerability Description
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
shd101wyy vscode-markdown-preview-enhanced < 0.8.30 -

II. Public POCs for CVE-2026-54701

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54701

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54701 (4)

Other References for CVE-2026-54701 (3)

Same Patch Batch · shd101wyy · 2026-10-14 · 5 CVEs total

CVE-2026-54525 8.8 HIGH Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows
CVE-2026-54566 8.5 HIGH Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/conf
CVE-2026-54702 7.3 HIGH Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler
CVE-2026-54703 5.8 MEDIUM Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Va

IV. Related Vulnerabilities

Same product: vscode-markdown-preview-enhanced
Same vendor: shd101wyy
Same weakness: CWE-79

V. Comments for CVE-2026-54701

No comments yet

Leave a comment