Markdown Preview Enhanced CVE-2026-54525

Exploitation is limited to Windows hosts running Markdown Preview Enhanced (crossnote) prior to 0.8.28 (crossnote 0.9.29), because the flaw depends on the Windows file-opening helper invoking child_process.exec with the start command through cmd.exe. The required trigger is concrete: the victim must open an attacker-controlled untrusted Markdown file in the preview and then click a crafted external or unsupported-scheme link whose decoded target contains shell metacharacters (e.g., command separators). Notably, the description explicitly states the attack does NOT require malicious workspace configuration/trust, does NOT require script execution to be enabled, and does NOT require any additional files - a single normal preview-link click suffices. The practical limiting factors defenders can rely on are the Windows-only platform dependency, the requirement for user interaction (opening the file and clicking the link), and the need for the user to be handling untrusted Markdown content.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) rates this high, driven by full confidentiality/integrity/availability impact from arbitrary command execution. However, the signals are mixed when assessed against real-world risk. The vector lists AV:N and PR:N (no authentication), but UI:R is the dominant limiter: exploitation requires a victim to open an attacker-supplied untrusted Markdown file AND click a crafted preview link - this is user-driven, social-engineering-dependent exploitation rather than remote drive-by. The flaw is also Windows-only (it depends on the Windows start-command helper invoking cmd.exe), which materially narrows the exposed population. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; no SSVC decision data was supplied either. Net: this is a legitimately serious code-execution bug worth prompt patching for Windows developers who handle untrusted Markdown, but it is not wormable or mass-exploitable internet-facing. Note the tension to verify: CVSS encodes AV:N yet the description implies attacker content must be locally opened and a link clicked, so the effective attack surface is closer to a document-based/local-interaction vector than true network exploitation.

An attacker distributes a seemingly benign Markdown file (for example a README in a shared repo or an emailed document) containing a link whose decoded target embeds Windows shell metacharacters. A Windows developer opens the file in Markdown Preview Enhanced's preview and clicks the crafted external/unsupported-scheme link, causing the start command to pass the target through cmd.exe and run the attacker's command with the user's privileges. No public exploit code was identified at the time of analysis, and no workspace trust, enabled scripts, or additional files are required.