SHD101WYY Vscode-Markdown-Preview-Enhanced vulnerabilities

5 CVEs affecting SHD101WYY Vscode-Markdown-Preview-Enhanced, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-54703, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-54525, published 2026-10-14. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to…
CVE-2026-54566, published 2026-10-14. High severity, CVSS 8.5. EPSS: 0.3% chance of exploitation in the next 30 days. Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and…
CVE-2026-54702, published 2026-10-14. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value…
CVE-2026-54703, published 2026-10-14. Medium severity, CVSS 5.8. EPSS: 0.2% chance of exploitation in the next 30 days. Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and…
CVE-2026-54701, published 2026-10-14. Medium severity, CVSS 6.9. EPSS: 0.2% chance of exploitation in the next 30 days. Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it…