Markdown Preview Enhanced EUVD-2026-101584

Requires: (1) the Markdown Preview Enhanced extension installed in VS Code; (2) the victim opening/cloning an attacker-controlled repository that contains a .crossnote/head.html file with script-capable markup; and (3) the victim opening a Markdown preview for a file in that repository (UI:P - merely opening the preview triggers it; no click in the notification or preview is needed). Limiting factors: the vector is local (the malicious repo must be present on the victim's machine), the specific .crossnote/head.html path must exist in the repo, and the extension must be installed and used to render a preview - there is no remote network trigger. Only versions prior to 0.8.30 are affected.

This is a moderate-severity, developer-targeted vulnerability rather than a mass-exploitation priority. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.9) correctly frames it as locally-vectored and requiring passive user interaction: exploitation depends on a victim cloning/opening a malicious repository and opening its Markdown preview, not on a remotely reachable network service. No EPSS score, CISA KEV listing, or SSVC decision data was provided, and no public exploit was referenced - so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The impact is meaningful: injected scripts in .crossnote/head.html execute before React, DOMPurify, and CSP defenses initialize, and can reach acquireVsCodeApi() to message the extension host, which (per the companion fix for blind command dispatch) could be chained toward arbitrary command invocation and file writes. This aligns with the vendor's VI:H (high integrity impact) while confidentiality/availability remain low. Net: a legitimate issue worth patching for anyone opening untrusted repositories, but its local vector and required user interaction keep it below the urgency of a network-exploitable flaw. Note the attack vector is local/UI-gated, so the raw '6.9' should not be read as remotely wormable.

An attacker publishes a malicious repository containing a crafted .crossnote/head.html with embedded script markup. A developer with Markdown Preview Enhanced installed clones the repo and opens any Markdown file's preview; the injected script runs in the webview head before DOMPurify/CSP load and calls acquireVsCodeApi() to post messages to the extension host. No additional click in the notification or preview is required, and no public exploit code was referenced in the provided data.