What is the CVSS score of CVE-2025-65716?

CVE-2025-65716 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Markdown Preview Enhanced are affected by CVE-2025-65716?

A critical vulnerability in Visual Studio Code's Markdown Preview Enhanced extension (CVE-2025-65716) enables attackers to execute arbitrary code when users open specially crafted markdown files.

Is there a public PoC exploit available for CVE-2025-65716?

Yes, a public proof-of-concept exploit is available for CVE-2025-65716. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-65716?

Within 24 hours: Issue an immediate security alert to all development teams advising against opening untrusted markdown files and disable the Markdown Preview Enhanced extension if not business-critical. Within 7 days: Conduct an inventory of which developers have this extension installed and assess usage necessity. Within 30 days: Implement endpoint monitoring for suspicious processes spawned from VS Code, enforce extension allowlisting policies, and prepare a rollout plan for patched versions once released.

Markdown Preview Enhanced CVE-2025-65716

HIGH

Code Injection (CWE-94)

2026-02-16 cve@mitre.org

RCE Code Injection Markdown Preview Enhanced Shd101Wyy

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 25, 2026 - 18:46 vuln.today

Public exploit code

CVE Published

Feb 16, 2026 - 16:19 nvd

HIGH 8.8

DescriptionCVE.org

An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file.

AnalysisAI

An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file. [CVSS 8.8 HIGH]

Technical ContextAI

Classified as CWE-94 (Code Injection). Affects Markdown Preview Enhanced. An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file.