CVE-2026-11422

In Markdown Preview Enhanced prior to 0.8.30, the _crossnote.updateMarkdown command accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS Code user's operating-system privileges.

Markdown Preview Enhanced, a Markdown preview extension for Visual Studio Code, prior to 0.8.30 does not validate the command value or arguments sent from the webview. JavaScript running in the preview can invoke privileged extension commands, including file modification, code execution, export-tool execution, and arbitrary URL opening. Exploitation requires a separate webview JavaScript execution path, such as the .crossnote/head.html injection.

In Markdown Preview Enhanced prior to 0.8.30, the extension reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi.

Markdown Preview Enhanced, a Markdown preview extension for Visual Studio Code, prior to 0.8.29 evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing OS command execution as the victim account without further interaction.

Markdown Preview Enhanced, a Markdown preview extension for Visual Studio Code, prior to 0.8.28 passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user.