Advisories · Technology
shd101wyy vscode-markdown-preview-enhanced.
Every CVE that names shd101wyy vscode-markdown-preview-enhanced among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.3 High
Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler
- shd101wyy vscode-markdown-preview-enhanced
- CWE-749
- CVSS 6.9 Medium
Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview
- shd101wyy vscode-markdown-preview-enhanced
- Cross-site scripting (XSS)
- CVSS 5.8 Medium
Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation
- shd101wyy vscode-markdown-preview-enhanced
- Path traversal
- CVSS 8.5 High
Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`
- shd101wyy vscode-markdown-preview-enhanced
- Code injection
- CVSS 8.8 High
Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows
- shd101wyy vscode-markdown-preview-enhanced
- Command injection