These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-54701 is a stored XSS vulnerability in Markdown Preview Enhanced, a Markdown preview extension for Visual Studio Code. The issue allows for unsanitized `.crossnote/head.html` injection in the webview, enabling script-capable markup execution before the React application and DOMPurify initialize. This can be triggered by opening a Markdown preview in a malicious repository.
The CVE-2026-54702 vulnerability in Markdown Preview Enhanced, a Visual Studio Code extension, allows for blind command dispatch via an unvalidated webview message handler. This issue, fixed in version 0.8.30, enables JavaScript executing in the preview webview to invoke privileged extension commands with attacker-selected arguments, potentially leading to file modification, code execution, and arbitrary URL opening.
The CVE-2026-54703 vulnerability in Markdown Preview Enhanced allows for arbitrary file writes via the updateMarkdown command without path validation. This issue, fixed in version 0.8.30, requires a separate webview JavaScript execution path to exploit. Users of affected versions should update to 0.8.30 or later to mitigate this risk. The vulnerability impacts users who preview untrusted content, and defe [truncated]
The CVE-2026-54566 vulnerability in Markdown Preview Enhanced allows for remote code execution via VM sandbox escape. Affected versions are before 0.8.29. Users should update to version 0.8.29 or later to mitigate this issue. The vulnerability is caused by the evaluation of repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security [truncated]
CVE-2026-54525 is a high-severity vulnerability in the Markdown Preview Enhanced extension for Visual Studio Code. An attacker can exploit this vulnerability by crafting a malicious Markdown link that, when clicked, can execute arbitrary commands on a Windows system with the privileges of the current VS Code user. This issue is fixed in version 0.8.28 of the extension.
CVE-2026-50733 is a high-severity vulnerability in Markdown Preview Enhanced, a popular extension for previewing and editing Markdown files. The vulnerability allows an attacker to execute arbitrary JavaScript code by crafting a malicious Markdown document that contains a WaveDrom diagram. When a victim previews or exports the document, the attacker can execute arbitrary code, potentially leading to arbit [truncated]
CVE-2026-49493 is a HIGH severity vulnerability in Markdown Preview Enhanced before 0.8.28. The vulnerability allows arbitrary code execution via bitfield fenced code blocks. A crafted markdown document containing a malicious bitfield code block executes attacker-controlled code on the server side when the document is rendered or exported. The vulnerability was fixed in version 0.8.28 by parsing bitfield [truncated]
CVE-2026-49492 is a HIGH severity vulnerability in Markdown Preview Enhanced before version 0.8.28. The vulnerability allows for OS command injection when a crafted markdown document is previewed on Windows. This is due to the application opening external files and links from the preview through a shell without validating untrusted inputs taken from the markdown document.