Markdown Preview Enhanced CVE-2026-54702

Exploitation requires a pre-existing webview JavaScript execution primitive inside the Markdown Preview Enhanced preview pane - specifically the independently tracked .crossnote/head.html script injection, or any equivalent path that reaches acquireVsCodeApi(). The victim must open attacker-controlled content (a malicious repository/Markdown file) in VS Code with the extension installed and render its preview, which supplies the passive user interaction (UI:P) the vector requires. Given that primitive, no authorization check protects the extension-host command boundary: the handler accepts any _crossnote.{command} with arbitrary args. LIMITING FACTORS: this is not remotely exploitable on its own (AV:L, AT:P), it is gated behind a second vulnerability, and both halves are remediated in 0.8.30 (the allowlist here plus the head.html <script>-stripping fix), so a fully patched install removes both the bridge abuse and its most practical trigger.

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:P, score 7.3 HIGH) encodes the key nuance: although privileges are not required (PR:N), the Attack Requirements metric is set to Present (AT:P) and user interaction is Passive (UI:P), reflecting that this bug is not independently exploitable. The description states plainly that exploitation 'requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection' - so CVE-2026-54702 is the second half of an exploit chain, not a standalone RCE. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so this is 'no public exploit identified at time of analysis.' The single 'RCE' tag is accurate in outcome (the bridge can reach file modification and code-chunk execution) but overstates immediacy, since a webview-compromise primitive must be obtained first. Signals are internally consistent: a local attack vector, a required precondition, and the absence of exploitation telemetry all point to a high-impact-but-gated issue appropriate for prompt patching rather than panic. Note the chained dependency explicitly - risk is realized only where the companion head.html injection (GHSA-mcwg-4j78-qwv3, fixed in the same 0.8.30 release) or an equivalent webview-script primitive is also present.

A developer clones or opens an attacker-controlled repository in VS Code and previews a Markdown file with Markdown Preview Enhanced. A malicious .crossnote/head.html in the repo injects script into the preview webview, which then abuses the unvalidated _crossnote message bridge to dispatch privileged extension-host commands (e.g. updateMarkdown, chromeExport/pandocExport) with attacker-chosen arguments, enabling file writes and code-chunk/export-tool execution on the victim's machine. No public exploit code was identified in the provided data, though the companion head.html injection it chains with is independently documented.