File Write Vulnerability in Markdown Preview Enhanced for Visual Studio Code

CVE-2026-54703

What is CVE-2026-54703?

Markdown Preview Enhanced for Visual Studio Code has a vulnerability that allows arbitrary file writing due to inadequate validation in the _crossnote.updateMarkdown command. This command accepts an arbitrary URI and attacker-controlled content, which can be executed by JavaScript running in the preview webview. This can lead to modifications of user files, including configuration and source files, if exploited. The issue was addressed in version 0.8.30, which introduced proper validation to mitigate this risk.

References