CVE-2026-54701: SHD101WYY Vscode-Markdown-Preview-Enhanced

Medium severity, CVSS 6.9. EPSS: 0.2% chance of exploitation in the next 30 days.

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30.

Affected products

Published 2026-10-14. Last modified 2026-10-16.