Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M

CVE-2026-54701Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview

Medium 6.9

In plain English

A medium-severity cross-site scripting in vscode-markdown-preview-enhanced from shd101wyy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 77.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30.

Affected products (as reported)

VendorProductVersions
shd101wyy vscode-markdown-preview-enhanced < 0.8.30

Weakness: CWE-79 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

References