Medium 6.9Published Oct 14, 2026

CVE-2026-54701Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview

Updated under an hour ago (Oct 27, 2026, 2:30 PM ET)

Does this affect you?

It affects shd101wyy vscode-markdown-preview-enhanced. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for shd101wyy vscode-markdown-preview-enhanced

Exploited in the last 30 days

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30.

CVSS: 6.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Awaiting Analysis
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

shd101wyy vscode-markdown-preview-enhanced shd101wyy:vscode_markdown_preview_enhanced (from the name)	before 0.8.30	CNA record

References

References

https://github.com/shd101wyy/vscode-markdown-preview-enhanced/security/advisories/GHSA-mcwg-4j78-qwv3	x-refsource-confirm
https://github.com/shd101wyy/crossnote/pull/444	x-refsource-misc
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/pull/2323	x-refsource-misc
https://github.com/shd101wyy/crossnote/commit/8c55a2ba3365712a1caa4abeece0383bc2994d48	x-refsource-misc
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/commit/8bc848b6cbb42b9f35a0f95f7c3bf29b8302970e	x-refsource-misc
https://github.com/shd101wyy/crossnote/releases/tag/0.9.31	x-refsource-misc
https://github.com/shd101wyy/vscode-markdown-preview-enhanced/releases/tag/0.8.30	x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.