CVE-2026-54701: Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Markdown Preview Enhancedto a version that resolves this vulnerability.Fixed in 0.8.30
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Markdown Preview Enhanced versions before 0.8.30 are exposed when they open a Markdown preview in a repository that contains attacker-controlled .crossnote/head.html content.
What does an attacker need to exploit it?
An attacker needs to control the repository’s .crossnote/head.html file and persuade a user to open a Markdown preview for that repository. No additional click in the preview or notification is required.
Is the injected content able to run before preview-side protections load?
Yes. Script-capable markup runs while the preview webview document loads, before the React application and DOMPurify initialize.
What can the injected code access?
The injected content can access acquireVsCodeApi and send messages from the webview to the extension host.
What is the available fix?
Upgrade Markdown Preview Enhanced to version 0.8.30, which fixes the issue.