Command Injection Vulnerability in Markdown Preview Enhanced for Visual Studio Code

CVE-2026-54702

What is CVE-2026-54702?

The Markdown Preview Enhanced extension in Visual Studio Code prior to version 0.8.30 has a command injection vulnerability due to a flaw in the webview message handler. An attacker can exploit this by providing controlled command values and arguments, enabling them to execute privileged commands. This potentially allows for file modifications, execution of code chunks, and arbitrary URL openings without proper authorization checks. The flaw is mitigated in version 0.8.30, highlighting the importance of maintaining up-to-date software.

References