CVE-2026-54703: Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS Code user's operating-system privileges, including user configuration, startup, source, and build files. This file-write vulnerability requires a separate webview JavaScript execution path, such as the independently tracked head.html injection and blind command-dispatch weaknesses. This issue is fixed in version 0.8.30.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Markdown Preview Enhancedto a version that resolves this vulnerability.Fixed in 0.8.30
Event History
Frequently Asked Questions
What must an attacker achieve before this file-write flaw can be exploited?
JavaScript must already be executing in the Markdown preview webview through a separate weakness, such as head.html injection or blind command dispatch. That code can then use the extension message bridge to invoke the vulnerable command.
What systems and files are at risk?
Any VS Code environment running a version prior to 0.8.30 is affected when attacker-controlled JavaScript can execute in the preview webview. The attacker can write files that the VS Code user is permitted to modify, including configuration, startup, source, and build files.
What should be done if an immediate update is not possible?
Prevent untrusted content from obtaining JavaScript execution in the Markdown preview webview, particularly through known paths such as head.html injection or blind command dispatch. Restricting the privileges of the operating-system account running VS Code also limits which files could be overwritten.
How can I determine whether the installed extension is vulnerable?
Check the installed Markdown Preview Enhanced version. Versions earlier than 0.8.30 are affected; version 0.8.30 contains the fix.