ZeroDay Findings
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-54525

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.

Published Oct 14, 2026 · catalog updated Oct 15, 2026 · Markdown Preview Enhanced is

Check if you run it

No confirmed exploitation is on record for CVE-2026-54525. EPSS is 0.43%. Act only if a listed version of Markdown Preview Enhanced is is installed.

Severity
High8.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.43%
Remediation
Advisory link
Affected products
See sources for product scope

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28.

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.

How to fix CVE-2026-54525

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-54525. EPSS is 0.43%. Act only if a listed version of Markdown Preview Enhanced is is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-78: OS Command Injection. EPSS 0.43%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · NIST NVD

    Detected

    Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, she

  2. Oct 15, 2026 · NIST NVD

    Updated

    Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, she

Sources

  • CVE.orgVulnerability recordCVE-2026-54525

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-54525

    30-day exploitation probability 0.4%

    first.org
  • NIST NVDVulnerability recordCVE-2026-54525

    Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start com

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.