Arbitrary Command Execution in Markdown Preview Enhanced for Visual Studio Code
CVE-2026-54525

8.8HIGH

Key Information:

Vendor

Shd101wyy

Status
Vscode-markdown-preview-enhanced
Vendor
CVE Published:
14 October 2026

What is CVE-2026-54525?

Markdown Preview Enhanced for Visual Studio Code has a vulnerability where the preview-link handling allows for crafted external links to execute arbitrary commands. Upon user interaction with an untrusted Markdown file, commands may be constructed through shell metacharacters, enabling unwanted actions to be carried out at the privileges of the current user. This issue, affecting versions prior to 0.8.28, has been resolved in the latest release.

Affected Version(s)

vscode-markdown-preview-enhanced < 0.8.28

References

https://github.com/shd101wyy/vscode-markdown-preview-enha...
x_refsource_CONFIRM
https://github.com/shd101wyy/crossnote/pull/442
x_refsource_MISC
https://github.com/shd101wyy/vscode-markdown-preview-enha...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.