Markdown Preview Enhanced is a Visual Studio Code extension that offers Markdown preview functionality. Prior to version 0.8.30 its webview message handler accepts command and args values supplied by JavaScript running inside the preview webview. The handler constructs a command in the _crossnote namespace and calls vscode.commands.executeCommand without an allowlist or type validation. Because the handler trusts the JavaScript context, an attacker who can inject code into or run arbitrary JavaScript in the preview can invoke privileged extension commands such as file modification, code execution, export-tool use, or arbitrary URL opening using attacker‑provided arguments. This can lead to data loss, execution of unintended code, or unwanted network activity.

All installations of the Markdown Preview Enhanced extension for Visual Studio Code with a version earlier than 0.8.30 are vulnerable. The affected vendor is shd101wyy and the product is the vscode‑markdown‑preview‑enhanced extension. Users who have installed versions 0.8.29 or earlier are at risk.

The CVSS score of 7.3 indicates a high severity threat. While an EPSS score is not available, the vulnerability is not listed in CISA KEV, suggesting no publicly reported exploitation at this time. However, exploitation requires that an attacker already controls the preview webview JavaScript execution vector, such as through the .crossnote/head.html injection vulnerability. Once that vector is established, there is no additional authorization barrier to invoke privileged extension commands, enabling potential data compromise or code execution on the host system.