Code Execution Vulnerability in Markdown Preview Enhanced for Visual Studio Code

CVE-2026-54701

What is CVE-2026-54701?

Markdown Preview Enhanced, a popular Markdown preview extension for Visual Studio Code, is susceptible to a code execution vulnerability when handling repository-controlled .crossnote/head.html content. Versions before 0.8.30 fail to sanitize the content before inserting it into the webview, allowing malicious scripts to execute when a user opens a Markdown preview in a compromised repository. This could enable attackers to send messages from the webview to the extension host without any additional user interaction, posing significant security risks. Users are advised to update to version 0.8.30 or later to mitigate this issue.

References