---
id: CVE-2026-54701
title: >-
  Markdown Preview Enhanced is a Markdown preview extension for Visual Studio
  Code
summary: >-
  Markdown Preview Enhanced is a Markdown preview extension for Visual Studio
  Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled
  .crossnote/head.html content and passes it through resolvePathsInHeader before
  inser…
severity: medium
cwe:
  - CWE-79
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:17:47.580'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54701'
references:
  - url: >-
      https://github.com/shd101wyy/crossnote/commit/8c55a2ba3365712a1caa4abeece0383bc2994d48
    label: security-advisories@github.com
  - url: 'https://github.com/shd101wyy/crossnote/pull/444'
    label: security-advisories@github.com
  - url: 'https://github.com/shd101wyy/crossnote/releases/tag/0.9.31'
    label: security-advisories@github.com
  - url: >-
      https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e
    label: security-advisories@github.com
  - url: 'https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323'
    label: security-advisories@github.com
  - url: >-
      https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30
    label: security-advisories@github.com
  - url: >-
      https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-mcwg-4j78-qwv3
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-14T20:53:12.376Z'
vendor: shd101wyy
product: vscode-markdown-preview-enhanced
affected:
  - vscode-markdown-preview-enhanced < 0.8.30
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
---

## Overview

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.