Markdown Preview Enhanced is a Visual Studio Code extension that renders Markdown in a webview. The extension’s hidden _crossnote.updateMarkdown command accepts an arbitrary URI and attacker‑controlled content and forwards those to vscode.workspace.fs.writeFile without validating that the target file is the one currently previewed. Because a JavaScript context can invoke this command through the extension’s message bridge, an attacker who can make the user load malicious webview content can write any file the VS Code user has permission to modify, including configuration, startup scripts, source files, and build artifacts. The weakness is a type‑of‑weakness problem described by CWE‑73 (Improper Validation of File Name or Path).

The flaw affects the vscode‑markdown‑preview‑enhanced extension by shd101wyy for Visual Studio Code. All installed versions before 0.8.30 are vulnerable. Any user who has the extension installed and has enabled its message‑bridge capability for webviews is at risk.

The CVSS base score of 5.8 indicates moderate severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting limited public exploitation. However, exploitation requires a separate webview JavaScript execution path, such as the head.html injection or blind command‑dispatch weaknesses that are tracked independently. Once that prerequisite is met, the attacker can write arbitrary files with the privileges of the VS Code user, potentially leading to persistence, code tampering, or compromise of user configuration.