All 5 CVE vulnerabilities found in vscode-markdown-preview-enhanced, with AI-generated Chinese analysis, references, and POCs.
Vendor: shd101wyy
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-54702 | Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler CWE-749 | 7.3 | High | 2026-10-14 |
| CVE-2026-54701 | Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview CWE-79 | 6.9 | Medium | 2026-10-14 |
| CVE-2026-54703 | Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation CWE-73 | 5.8 | Medium | 2026-10-14 |
| CVE-2026-54566 | Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js` CWE-94 | 8.5 | High | 2026-10-14 |
| CVE-2026-54525 | Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows CWE-78 | 8.8 | High | 2026-10-14 |
All 5 known CVE vulnerabilities affecting vscode-markdown-preview-enhanced with full Chinese analysis, references, and POCs where available.